image/imgLoader.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 // Undefine windows version of LoadImage because our code uses that name.
   8 #include "mozilla/ScopeExit.h"
   9 #include "nsIChildChannel.h"
  10 #undef LoadImage
  11
  12 #include "imgLoader.h"
  13
  14 #include <algorithm>
  15 #include <utility>
  16
  17 #include "DecoderFactory.h"
  18 #include "Image.h"
  19 #include "ImageLogging.h"
  20 #include "ReferrerInfo.h"
  21 #include "imgRequestProxy.h"
  22 #include "mozilla/Attributes.h"
  23 #include "mozilla/BasePrincipal.h"
  24 #include "mozilla/ChaosMode.h"
  25 #include "mozilla/ClearOnShutdown.h"
  26 #include "mozilla/LoadInfo.h"
  27 #include "mozilla/NullPrincipal.h"
  28 #include "mozilla/Preferences.h"
  29 #include "mozilla/ProfilerLabels.h"
  30 #include "mozilla/StaticPrefs_image.h"
  31 #include "mozilla/StaticPrefs_network.h"
  32 #include "mozilla/StoragePrincipalHelper.h"
  33 #include "mozilla/dom/ContentParent.h"
  34 #include "mozilla/dom/nsMixedContentBlocker.h"
  35 #include "mozilla/image/ImageMemoryReporter.h"
  36 #include "mozilla/layers/CompositorManagerChild.h"
  37 #include "nsCOMPtr.h"
  38 #include "nsCRT.h"
  39 #include "nsComponentManagerUtils.h"
  40 #include "nsContentPolicyUtils.h"
  41 #include "nsContentSecurityManager.h"
  42 #include "nsContentUtils.h"
  43 #include "nsHttpChannel.h"
  44 #include "nsIAsyncVerifyRedirectCallback.h"
  45 #include "nsICacheInfoChannel.h"
  46 #include "nsIChannelEventSink.h"
  47 #include "nsIClassOfService.h"
  48 #include "nsIEffectiveTLDService.h"
  49 #include "nsIFile.h"
  50 #include "nsIFileURL.h"
  51 #include "nsIHttpChannel.h"
  52 #include "nsIInterfaceRequestor.h"
  53 #include "nsIInterfaceRequestorUtils.h"
  54 #include "nsIMemoryReporter.h"
  55 #include "nsINetworkPredictor.h"
  56 #include "nsIProgressEventSink.h"
  57 #include "nsIProtocolHandler.h"
  58 #include "nsImageModule.h"
  59 #include "nsMediaSniffer.h"
  60 #include "nsMimeTypes.h"
  61 #include "nsNetCID.h"
  62 #include "nsNetUtil.h"
  63 #include "nsProxyRelease.h"
  64 #include "nsQueryObject.h"
  65 #include "nsReadableUtils.h"
  66 #include "nsStreamUtils.h"
  67 #include "prtime.h"
  68
  69 // we want to explore making the document own the load group
  70 // so we can associate the document URI with the load group.
  71 // until this point, we have an evil hack:
  72 #include "nsIHttpChannelInternal.h"
  73 #include "nsILoadGroupChild.h"
  74 #include "nsIDocShell.h"
  75
  76 using namespace mozilla;
  77 using namespace mozilla::dom;
  78 using namespace mozilla::image;
  79 using namespace mozilla::net;
  80
  81 MOZ_DEFINE_MALLOC_SIZE_OF(ImagesMallocSizeOf)
  82
  83 class imgMemoryReporter final : public nsIMemoryReporter {
  84   ~imgMemoryReporter() = default;
  85
  86  public:
  87   NS_DECL_ISUPPORTS
  88
  89   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
  90                             nsISupports* aData, bool aAnonymize) override {
  91     MOZ_ASSERT(NS_IsMainThread());
  92
  93     layers::CompositorManagerChild* manager =
  94         mozilla::layers::CompositorManagerChild::GetInstance();
  95     if (!manager || !StaticPrefs::image_mem_debug_reporting()) {
  96       layers::SharedSurfacesMemoryReport sharedSurfaces;
  97       FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
  98       return NS_OK;
  99     }
 100
 101     RefPtr<imgMemoryReporter> self(this);
 102     nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
 103     nsCOMPtr<nsISupports> data(aData);
 104     manager->SendReportSharedSurfacesMemory(
 105         [=](layers::SharedSurfacesMemoryReport aReport) {
 106           self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
 107         },
 108         [=](mozilla::ipc::ResponseRejectReason&& aReason) {
 109           layers::SharedSurfacesMemoryReport sharedSurfaces;
 110           self->FinishCollectReports(handleReport, data, aAnonymize,
 111                                      sharedSurfaces);
 112         });
 113     return NS_OK;
 114   }
 115
 116   void FinishCollectReports(
 117       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 118       bool aAnonymize, layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 119     nsTArray<ImageMemoryCounter> chrome;
 120     nsTArray<ImageMemoryCounter> content;
 121     nsTArray<ImageMemoryCounter> uncached;
 122
 123     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
 124       for (imgCacheEntry* entry : mKnownLoaders[i]->mCache.Values()) {
 125         RefPtr<imgRequest> req = entry->GetRequest();
 126         RecordCounterForRequest(req, &content, !entry->HasNoProxies());
 127       }
 128       MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
 129       for (RefPtr<imgRequest> req : mKnownLoaders[i]->mUncachedImages) {
 130         RecordCounterForRequest(req, &uncached, req->HasConsumers());
 131       }
 132     }
 133
 134     // Note that we only need to anonymize content image URIs.
 135
 136     ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
 137                        /* aAnonymize */ false, aSharedSurfaces);
 138
 139     ReportCounterArray(aHandleReport, aData, content, "images/content",
 140                        aAnonymize, aSharedSurfaces);
 141
 142     // Uncached images may be content or chrome, so anonymize them.
 143     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
 144                        aAnonymize, aSharedSurfaces);
 145
 146     // Report any shared surfaces that were not merged with the surface cache.
 147     ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
 148                                               aSharedSurfaces);
 149
 150     nsCOMPtr<nsIMemoryReporterManager> imgr =
 151         do_GetService("@mozilla.org/memory-reporter-manager;1");
 152     if (imgr) {
 153       imgr->EndReport();
 154     }
 155   }
 156
 157   static int64_t ImagesContentUsedUncompressedDistinguishedAmount() {
 158     size_t n = 0;
 159     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
 160          i++) {
 161       for (imgCacheEntry* entry :
 162            imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Values()) {
 163         if (entry->HasNoProxies()) {
 164           continue;
 165         }
 166
 167         RefPtr<imgRequest> req = entry->GetRequest();
 168         RefPtr<image::Image> image = req->GetImage();
 169         if (!image) {
 170           continue;
 171         }
 172
 173         // Both this and EntryImageSizes measure
 174         // images/content/raster/used/decoded memory.  This function's
 175         // measurement is secondary -- the result doesn't go in the "explicit"
 176         // tree -- so we use moz_malloc_size_of instead of ImagesMallocSizeOf to
 177         // prevent DMD from seeing it reported twice.
 178         SizeOfState state(moz_malloc_size_of);
 179         ImageMemoryCounter counter(req, image, state, /* aIsUsed = */ true);
 180
 181         n += counter.Values().DecodedHeap();
 182         n += counter.Values().DecodedNonHeap();
 183         n += counter.Values().DecodedUnknown();
 184       }
 185     }
 186     return n;
 187   }
 188
 189   void RegisterLoader(imgLoader* aLoader) {
 190     mKnownLoaders.AppendElement(aLoader);
 191   }
 192
 193   void UnregisterLoader(imgLoader* aLoader) {
 194     mKnownLoaders.RemoveElement(aLoader);
 195   }
 196
 197  private:
 198   nsTArray<imgLoader*> mKnownLoaders;
 199
 200   struct MemoryTotal {
 201     MemoryTotal& operator+=(const ImageMemoryCounter& aImageCounter) {
 202       if (aImageCounter.Type() == imgIContainer::TYPE_RASTER) {
 203         if (aImageCounter.IsUsed()) {
 204           mUsedRasterCounter += aImageCounter.Values();
 205         } else {
 206           mUnusedRasterCounter += aImageCounter.Values();
 207         }
 208       } else if (aImageCounter.Type() == imgIContainer::TYPE_VECTOR) {
 209         if (aImageCounter.IsUsed()) {
 210           mUsedVectorCounter += aImageCounter.Values();
 211         } else {
 212           mUnusedVectorCounter += aImageCounter.Values();
 213         }
 214       } else if (aImageCounter.Type() == imgIContainer::TYPE_REQUEST) {
 215         // Nothing to do, we did not get to the point of having an image.
 216       } else {
 217         MOZ_CRASH("Unexpected image type");
 218       }
 219
 220       return *this;
 221     }
 222
 223     const MemoryCounter& UsedRaster() const { return mUsedRasterCounter; }
 224     const MemoryCounter& UnusedRaster() const { return mUnusedRasterCounter; }
 225     const MemoryCounter& UsedVector() const { return mUsedVectorCounter; }
 226     const MemoryCounter& UnusedVector() const { return mUnusedVectorCounter; }
 227
 228    private:
 229     MemoryCounter mUsedRasterCounter;
 230     MemoryCounter mUnusedRasterCounter;
 231     MemoryCounter mUsedVectorCounter;
 232     MemoryCounter mUnusedVectorCounter;
 233   };
 234
 235   // Reports all images of a single kind, e.g. all used chrome images.
 236   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
 237                           nsISupports* aData,
 238                           nsTArray<ImageMemoryCounter>& aCounterArray,
 239                           const char* aPathPrefix, bool aAnonymize,
 240                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 241     MemoryTotal summaryTotal;
 242     MemoryTotal nonNotableTotal;
 243
 244     // Report notable images, and compute total and non-notable aggregate sizes.
 245     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
 246       ImageMemoryCounter& counter = aCounterArray[i];
 247
 248       if (aAnonymize) {
 249         counter.URI().Truncate();
 250         counter.URI().AppendPrintf("<anonymized-%u>", i);
 251       } else {
 252         // The URI could be an extremely long data: URI. Truncate if needed.
 253         static const size_t max = 256;
 254         if (counter.URI().Length() > max) {
 255           counter.URI().Truncate(max);
 256           counter.URI().AppendLiteral(" (truncated)");
 257         }
 258         counter.URI().ReplaceChar('/', '\\');
 259       }
 260
 261       summaryTotal += counter;
 262
 263       if (counter.IsNotable() || StaticPrefs::image_mem_debug_reporting()) {
 264         ReportImage(aHandleReport, aData, aPathPrefix, counter,
 265                     aSharedSurfaces);
 266       } else {
 267         ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
 268         nonNotableTotal += counter;
 269       }
 270     }
 271
 272     // Report non-notable images in aggregate.
 273     ReportTotal(aHandleReport, aData, /* aExplicit = */ true, aPathPrefix,
 274                 "<non-notable images>/", nonNotableTotal);
 275
 276     // Report a summary in aggregate, outside of the explicit tree.
 277     ReportTotal(aHandleReport, aData, /* aExplicit = */ false, aPathPrefix, "",
 278                 summaryTotal);
 279   }
 280
 281   static void ReportImage(nsIHandleReportCallback* aHandleReport,
 282                           nsISupports* aData, const char* aPathPrefix,
 283                           const ImageMemoryCounter& aCounter,
 284                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 285     nsAutoCString pathPrefix("explicit/"_ns);
 286     pathPrefix.Append(aPathPrefix);
 287
 288     switch (aCounter.Type()) {
 289       case imgIContainer::TYPE_RASTER:
 290         pathPrefix.AppendLiteral("/raster/");
 291         break;
 292       case imgIContainer::TYPE_VECTOR:
 293         pathPrefix.AppendLiteral("/vector/");
 294         break;
 295       case imgIContainer::TYPE_REQUEST:
 296         pathPrefix.AppendLiteral("/request/");
 297         break;
 298       default:
 299         pathPrefix.AppendLiteral("/unknown=");
 300         pathPrefix.AppendInt(aCounter.Type());
 301         pathPrefix.AppendLiteral("/");
 302         break;
 303     }
 304
 305     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
 306     if (aCounter.IsValidating()) {
 307       pathPrefix.AppendLiteral("validating/");
 308     }
 309     if (aCounter.HasError()) {
 310       pathPrefix.AppendLiteral("err/");
 311     }
 312
 313     pathPrefix.AppendLiteral("progress=");
 314     pathPrefix.AppendInt(aCounter.Progress(), 16);
 315     pathPrefix.AppendLiteral("/");
 316
 317     pathPrefix.AppendLiteral("image(");
 318     pathPrefix.AppendInt(aCounter.IntrinsicSize().width);
 319     pathPrefix.AppendLiteral("x");
 320     pathPrefix.AppendInt(aCounter.IntrinsicSize().height);
 321     pathPrefix.AppendLiteral(", ");
 322
 323     if (aCounter.URI().IsEmpty()) {
 324       pathPrefix.AppendLiteral("<unknown URI>");
 325     } else {
 326       pathPrefix.Append(aCounter.URI());
 327     }
 328
 329     pathPrefix.AppendLiteral(")/");
 330
 331     ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 332
 333     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
 334   }
 335
 336   static void ReportSurfaces(
 337       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 338       const nsACString& aPathPrefix, const ImageMemoryCounter& aCounter,
 339       layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 340     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
 341       nsAutoCString surfacePathPrefix(aPathPrefix);
 342       switch (counter.Type()) {
 343         case SurfaceMemoryCounterType::NORMAL:
 344           if (counter.IsLocked()) {
 345             surfacePathPrefix.AppendLiteral("locked/");
 346           } else {
 347             surfacePathPrefix.AppendLiteral("unlocked/");
 348           }
 349           if (counter.IsFactor2()) {
 350             surfacePathPrefix.AppendLiteral("factor2/");
 351           }
 352           if (counter.CannotSubstitute()) {
 353             surfacePathPrefix.AppendLiteral("cannot_substitute/");
 354           }
 355           break;
 356         case SurfaceMemoryCounterType::CONTAINER:
 357           surfacePathPrefix.AppendLiteral("container/");
 358           break;
 359         default:
 360           MOZ_ASSERT_UNREACHABLE("Unknown counter type");
 361           break;
 362       }
 363
 364       surfacePathPrefix.AppendLiteral("types=");
 365       surfacePathPrefix.AppendInt(counter.Values().SurfaceTypes(), 16);
 366       surfacePathPrefix.AppendLiteral("/surface(");
 367       surfacePathPrefix.AppendInt(counter.Key().Size().width);
 368       surfacePathPrefix.AppendLiteral("x");
 369       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 370
 371       if (!counter.IsFinished()) {
 372         surfacePathPrefix.AppendLiteral(", incomplete");
 373       }
 374
 375       if (counter.Values().ExternalHandles() > 0) {
 376         surfacePathPrefix.AppendLiteral(", handles:");
 377         surfacePathPrefix.AppendInt(
 378             uint32_t(counter.Values().ExternalHandles()));
 379       }
 380
 381       ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
 382                                                      aSharedSurfaces);
 383
 384       PlaybackType playback = counter.Key().Playback();
 385       if (playback == PlaybackType::eAnimated) {
 386         if (StaticPrefs::image_mem_debug_reporting()) {
 387           surfacePathPrefix.AppendPrintf(
 388               " (animation %4u)", uint32_t(counter.Values().FrameIndex()));
 389         } else {
 390           surfacePathPrefix.AppendLiteral(" (animation)");
 391         }
 392       }
 393
 394       if (counter.Key().Flags() != DefaultSurfaceFlags()) {
 395         surfacePathPrefix.AppendLiteral(", flags:");
 396         surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
 397                                     /* aRadix = */ 16);
 398       }
 399
 400       if (counter.Key().Region()) {
 401         const ImageIntRegion& region = counter.Key().Region().ref();
 402         const gfx::IntRect& rect = region.Rect();
 403         surfacePathPrefix.AppendLiteral(", region:[ rect=(");
 404         surfacePathPrefix.AppendInt(rect.x);
 405         surfacePathPrefix.AppendLiteral(",");
 406         surfacePathPrefix.AppendInt(rect.y);
 407         surfacePathPrefix.AppendLiteral(") ");
 408         surfacePathPrefix.AppendInt(rect.width);
 409         surfacePathPrefix.AppendLiteral("x");
 410         surfacePathPrefix.AppendInt(rect.height);
 411         if (region.IsRestricted()) {
 412           const gfx::IntRect& restrict = region.Restriction();
 413           if (restrict == rect) {
 414             surfacePathPrefix.AppendLiteral(", restrict=rect");
 415           } else {
 416             surfacePathPrefix.AppendLiteral(", restrict=(");
 417             surfacePathPrefix.AppendInt(restrict.x);
 418             surfacePathPrefix.AppendLiteral(",");
 419             surfacePathPrefix.AppendInt(restrict.y);
 420             surfacePathPrefix.AppendLiteral(") ");
 421             surfacePathPrefix.AppendInt(restrict.width);
 422             surfacePathPrefix.AppendLiteral("x");
 423             surfacePathPrefix.AppendInt(restrict.height);
 424           }
 425         }
 426         if (region.GetExtendMode() != gfx::ExtendMode::CLAMP) {
 427           surfacePathPrefix.AppendLiteral(", extendMode=");
 428           surfacePathPrefix.AppendInt(int32_t(region.GetExtendMode()));
 429         }
 430         surfacePathPrefix.AppendLiteral("]");
 431       }
 432
 433       const SVGImageContext& context = counter.Key().SVGContext();
 434       surfacePathPrefix.AppendLiteral(", svgContext:[ ");
 435       if (context.GetViewportSize()) {
 436         const CSSIntSize& size = context.GetViewportSize().ref();
 437         surfacePathPrefix.AppendLiteral("viewport=(");
 438         surfacePathPrefix.AppendInt(size.width);
 439         surfacePathPrefix.AppendLiteral("x");
 440         surfacePathPrefix.AppendInt(size.height);
 441         surfacePathPrefix.AppendLiteral(") ");
 442       }
 443       if (context.GetPreserveAspectRatio()) {
 444         nsAutoString aspect;
 445         context.GetPreserveAspectRatio()->ToString(aspect);
 446         surfacePathPrefix.AppendLiteral("preserveAspectRatio=(");
 447         LossyAppendUTF16toASCII(aspect, surfacePathPrefix);
 448         surfacePathPrefix.AppendLiteral(") ");
 449       }
 450       if (auto scheme = context.GetColorScheme()) {
 451         surfacePathPrefix.AppendLiteral("colorScheme=");
 452         surfacePathPrefix.AppendInt(int32_t(*scheme));
 453         surfacePathPrefix.AppendLiteral(" ");
 454       }
 455       if (context.GetContextPaint()) {
 456         const SVGEmbeddingContextPaint* paint = context.GetContextPaint();
 457         surfacePathPrefix.AppendLiteral("contextPaint=(");
 458         if (paint->GetFill()) {
 459           surfacePathPrefix.AppendLiteral(" fill=");
 460           surfacePathPrefix.AppendInt(paint->GetFill()->ToABGR(), 16);
 461         }
 462         if (paint->GetFillOpacity() != 1.0) {
 463           surfacePathPrefix.AppendLiteral(" fillOpa=");
 464           surfacePathPrefix.AppendFloat(paint->GetFillOpacity());
 465         }
 466         if (paint->GetStroke()) {
 467           surfacePathPrefix.AppendLiteral(" stroke=");
 468           surfacePathPrefix.AppendInt(paint->GetStroke()->ToABGR(), 16);
 469         }
 470         if (paint->GetStrokeOpacity() != 1.0) {
 471           surfacePathPrefix.AppendLiteral(" strokeOpa=");
 472           surfacePathPrefix.AppendFloat(paint->GetStrokeOpacity());
 473         }
 474         surfacePathPrefix.AppendLiteral(" ) ");
 475       }
 476       surfacePathPrefix.AppendLiteral("]");
 477
 478       surfacePathPrefix.AppendLiteral(")/");
 479
 480       ReportValues(aHandleReport, aData, surfacePathPrefix, counter.Values());
 481     }
 482   }
 483
 484   static void ReportTotal(nsIHandleReportCallback* aHandleReport,
 485                           nsISupports* aData, bool aExplicit,
 486                           const char* aPathPrefix, const char* aPathInfix,
 487                           const MemoryTotal& aTotal) {
 488     nsAutoCString pathPrefix;
 489     if (aExplicit) {
 490       pathPrefix.AppendLiteral("explicit/");
 491     }
 492     pathPrefix.Append(aPathPrefix);
 493
 494     nsAutoCString rasterUsedPrefix(pathPrefix);
 495     rasterUsedPrefix.AppendLiteral("/raster/used/");
 496     rasterUsedPrefix.Append(aPathInfix);
 497     ReportValues(aHandleReport, aData, rasterUsedPrefix, aTotal.UsedRaster());
 498
 499     nsAutoCString rasterUnusedPrefix(pathPrefix);
 500     rasterUnusedPrefix.AppendLiteral("/raster/unused/");
 501     rasterUnusedPrefix.Append(aPathInfix);
 502     ReportValues(aHandleReport, aData, rasterUnusedPrefix,
 503                  aTotal.UnusedRaster());
 504
 505     nsAutoCString vectorUsedPrefix(pathPrefix);
 506     vectorUsedPrefix.AppendLiteral("/vector/used/");
 507     vectorUsedPrefix.Append(aPathInfix);
 508     ReportValues(aHandleReport, aData, vectorUsedPrefix, aTotal.UsedVector());
 509
 510     nsAutoCString vectorUnusedPrefix(pathPrefix);
 511     vectorUnusedPrefix.AppendLiteral("/vector/unused/");
 512     vectorUnusedPrefix.Append(aPathInfix);
 513     ReportValues(aHandleReport, aData, vectorUnusedPrefix,
 514                  aTotal.UnusedVector());
 515   }
 516
 517   static void ReportValues(nsIHandleReportCallback* aHandleReport,
 518                            nsISupports* aData, const nsACString& aPathPrefix,
 519                            const MemoryCounter& aCounter) {
 520     ReportSourceValue(aHandleReport, aData, aPathPrefix, aCounter);
 521
 522     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "decoded-heap",
 523                 "Decoded image data which is stored on the heap.",
 524                 aCounter.DecodedHeap());
 525
 526     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 527                 "decoded-nonheap",
 528                 "Decoded image data which isn't stored on the heap.",
 529                 aCounter.DecodedNonHeap());
 530
 531     // We don't know for certain whether or not it is on the heap, so let's
 532     // just report it as non-heap for reporting purposes.
 533     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 534                 "decoded-unknown",
 535                 "Decoded image data which is unknown to be on the heap or not.",
 536                 aCounter.DecodedUnknown());
 537   }
 538
 539   static void ReportSourceValue(nsIHandleReportCallback* aHandleReport,
 540                                 nsISupports* aData,
 541                                 const nsACString& aPathPrefix,
 542                                 const MemoryCounter& aCounter) {
 543     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "source",
 544                 "Raster image source data and vector image documents.",
 545                 aCounter.Source());
 546   }
 547
 548   static void ReportValue(nsIHandleReportCallback* aHandleReport,
 549                           nsISupports* aData, int32_t aKind,
 550                           const nsACString& aPathPrefix,
 551                           const char* aPathSuffix, const char* aDescription,
 552                           size_t aValue) {
 553     if (aValue == 0) {
 554       return;
 555     }
 556
 557     nsAutoCString desc(aDescription);
 558     nsAutoCString path(aPathPrefix);
 559     path.Append(aPathSuffix);
 560
 561     aHandleReport->Callback(""_ns, path, aKind, UNITS_BYTES, aValue, desc,
 562                             aData);
 563   }
 564
 565   static void RecordCounterForRequest(imgRequest* aRequest,
 566                                       nsTArray<ImageMemoryCounter>* aArray,
 567                                       bool aIsUsed) {
 568     SizeOfState state(ImagesMallocSizeOf);
 569     RefPtr<image::Image> image = aRequest->GetImage();
 570     if (image) {
 571       ImageMemoryCounter counter(aRequest, image, state, aIsUsed);
 572       aArray->AppendElement(std::move(counter));
 573     } else {
 574       // We can at least record some information about the image from the
 575       // request, and mark it as not knowing the image type yet.
 576       ImageMemoryCounter counter(aRequest, state, aIsUsed);
 577       aArray->AppendElement(std::move(counter));
 578     }
 579   }
 580 };
 581
 582 NS_IMPL_ISUPPORTS(imgMemoryReporter, nsIMemoryReporter)
 583
 584 NS_IMPL_ISUPPORTS(nsProgressNotificationProxy, nsIProgressEventSink,
 585                   nsIChannelEventSink, nsIInterfaceRequestor)
 586
 587 NS_IMETHODIMP
 588 nsProgressNotificationProxy::OnProgress(nsIRequest* request, int64_t progress,
 589                                         int64_t progressMax) {
 590   nsCOMPtr<nsILoadGroup> loadGroup;
 591   request->GetLoadGroup(getter_AddRefs(loadGroup));
 592
 593   nsCOMPtr<nsIProgressEventSink> target;
 594   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 595                                 NS_GET_IID(nsIProgressEventSink),
 596                                 getter_AddRefs(target));
 597   if (!target) {
 598     return NS_OK;
 599   }
 600   return target->OnProgress(mImageRequest, progress, progressMax);
 601 }
 602
 603 NS_IMETHODIMP
 604 nsProgressNotificationProxy::OnStatus(nsIRequest* request, nsresult status,
 605                                       const char16_t* statusArg) {
 606   nsCOMPtr<nsILoadGroup> loadGroup;
 607   request->GetLoadGroup(getter_AddRefs(loadGroup));
 608
 609   nsCOMPtr<nsIProgressEventSink> target;
 610   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 611                                 NS_GET_IID(nsIProgressEventSink),
 612                                 getter_AddRefs(target));
 613   if (!target) {
 614     return NS_OK;
 615   }
 616   return target->OnStatus(mImageRequest, status, statusArg);
 617 }
 618
 619 NS_IMETHODIMP
 620 nsProgressNotificationProxy::AsyncOnChannelRedirect(
 621     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
 622     nsIAsyncVerifyRedirectCallback* cb) {
 623   // Tell the original original callbacks about it too
 624   nsCOMPtr<nsILoadGroup> loadGroup;
 625   newChannel->GetLoadGroup(getter_AddRefs(loadGroup));
 626   nsCOMPtr<nsIChannelEventSink> target;
 627   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 628                                 NS_GET_IID(nsIChannelEventSink),
 629                                 getter_AddRefs(target));
 630   if (!target) {
 631     cb->OnRedirectVerifyCallback(NS_OK);
 632     return NS_OK;
 633   }
 634
 635   // Delegate to |target| if set, reusing |cb|
 636   return target->AsyncOnChannelRedirect(oldChannel, newChannel, flags, cb);
 637 }
 638
 639 NS_IMETHODIMP
 640 nsProgressNotificationProxy::GetInterface(const nsIID& iid, void** result) {
 641   if (iid.Equals(NS_GET_IID(nsIProgressEventSink))) {
 642     *result = static_cast<nsIProgressEventSink*>(this);
 643     NS_ADDREF_THIS();
 644     return NS_OK;
 645   }
 646   if (iid.Equals(NS_GET_IID(nsIChannelEventSink))) {
 647     *result = static_cast<nsIChannelEventSink*>(this);
 648     NS_ADDREF_THIS();
 649     return NS_OK;
 650   }
 651   if (mOriginalCallbacks) {
 652     return mOriginalCallbacks->GetInterface(iid, result);
 653   }
 654   return NS_NOINTERFACE;
 655 }
 656
 657 static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry,
 658                                imgLoader* aLoader, const ImageCacheKey& aKey,
 659                                imgRequest** aRequest, imgCacheEntry** aEntry) {
 660   RefPtr<imgRequest> request = new imgRequest(aLoader, aKey);
 661   RefPtr<imgCacheEntry> entry =
 662       new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
 663   aLoader->AddToUncachedImages(request);
 664   request.forget(aRequest);
 665   entry.forget(aEntry);
 666 }
 667
 668 static bool ShouldRevalidateEntry(imgCacheEntry* aEntry, nsLoadFlags aFlags,
 669                                   bool aHasExpired) {
 670   if (aFlags & nsIRequest::LOAD_BYPASS_CACHE) {
 671     return false;
 672   }
 673   if (aFlags & nsIRequest::VALIDATE_ALWAYS) {
 674     return true;
 675   }
 676   if (aEntry->GetMustValidate()) {
 677     return true;
 678   }
 679   if (aHasExpired) {
 680     // The cache entry has expired...  Determine whether the stale cache
 681     // entry can be used without validation...
 682     if (aFlags & (nsIRequest::LOAD_FROM_CACHE | nsIRequest::VALIDATE_NEVER |
 683                   nsIRequest::VALIDATE_ONCE_PER_SESSION)) {
 684       // LOAD_FROM_CACHE, VALIDATE_NEVER and VALIDATE_ONCE_PER_SESSION allow
 685       // stale cache entries to be used unless they have been explicitly marked
 686       // to indicate that revalidation is necessary.
 687       return false;
 688     }
 689     // Entry is expired, revalidate.
 690     return true;
 691   }
 692   return false;
 693 }
 694
 695 /* Call content policies on cached images that went through a redirect */
 696 static bool ShouldLoadCachedImage(imgRequest* aImgRequest,
 697                                   Document* aLoadingDocument,
 698                                   nsIPrincipal* aTriggeringPrincipal,
 699                                   nsContentPolicyType aPolicyType,
 700                                   bool aSendCSPViolationReports) {
 701   /* Call content policies on cached images - Bug 1082837
 702    * Cached images are keyed off of the first uri in a redirect chain.
 703    * Hence content policies don't get a chance to test the intermediate hops
 704    * or the final destination.  Here we test the final destination using
 705    * mFinalURI off of the imgRequest and passing it into content policies.
 706    * For Mixed Content Blocker, we do an additional check to determine if any
 707    * of the intermediary hops went through an insecure redirect with the
 708    * mHadInsecureRedirect flag
 709    */
 710   bool insecureRedirect = aImgRequest->HadInsecureRedirect();
 711   nsCOMPtr<nsIURI> contentLocation;
 712   aImgRequest->GetFinalURI(getter_AddRefs(contentLocation));
 713   nsresult rv;
 714
 715   nsCOMPtr<nsIPrincipal> loadingPrincipal =
 716       aLoadingDocument ? aLoadingDocument->NodePrincipal()
 717                        : aTriggeringPrincipal;
 718   // If there is no context and also no triggeringPrincipal, then we use a fresh
 719   // nullPrincipal as the loadingPrincipal because we can not create a loadinfo
 720   // without a valid loadingPrincipal.
 721   if (!loadingPrincipal) {
 722     loadingPrincipal = NullPrincipal::CreateWithoutOriginAttributes();
 723   }
 724
 725   nsCOMPtr<nsILoadInfo> secCheckLoadInfo = new LoadInfo(
 726       loadingPrincipal, aTriggeringPrincipal, aLoadingDocument,
 727       nsILoadInfo::SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK, aPolicyType);
 728
 729   secCheckLoadInfo->SetSendCSPViolationEvents(aSendCSPViolationReports);
 730
 731   int16_t decision = nsIContentPolicy::REJECT_REQUEST;
 732   rv = NS_CheckContentLoadPolicy(contentLocation, secCheckLoadInfo,
 733                                  ""_ns,  // mime guess
 734                                  &decision, nsContentUtils::GetContentPolicy());
 735   if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 736     return false;
 737   }
 738
 739   // We call all Content Policies above, but we also have to call mcb
 740   // individually to check the intermediary redirect hops are secure.
 741   if (insecureRedirect) {
 742     // Bug 1314356: If the image ended up in the cache upgraded by HSTS and the
 743     // page uses upgrade-inscure-requests it had an insecure redirect
 744     // (http->https). We need to invalidate the image and reload it because
 745     // mixed content blocker only bails if upgrade-insecure-requests is set on
 746     // the doc and the resource load is http: which would result in an incorrect
 747     // mixed content warning.
 748     nsCOMPtr<nsIDocShell> docShell =
 749         NS_CP_GetDocShellFromContext(ToSupports(aLoadingDocument));
 750     if (docShell) {
 751       Document* document = docShell->GetDocument();
 752       if (document && document->GetUpgradeInsecureRequests(false)) {
 753         return false;
 754       }
 755     }
 756
 757     if (!aTriggeringPrincipal || !aTriggeringPrincipal->IsSystemPrincipal()) {
 758       // reset the decision for mixed content blocker check
 759       decision = nsIContentPolicy::REJECT_REQUEST;
 760       rv = nsMixedContentBlocker::ShouldLoad(insecureRedirect, contentLocation,
 761                                              secCheckLoadInfo,
 762                                              ""_ns,  // mime guess
 763                                              true,   // aReportError
 764                                              &decision);
 765       if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 766         return false;
 767       }
 768     }
 769   }
 770
 771   return true;
 772 }
 773
 774 // Returns true if this request is compatible with the given CORS mode on the
 775 // given loading principal, and false if the request may not be reused due
 776 // to CORS.
 777 static bool ValidateCORSMode(imgRequest* aRequest, bool aForcePrincipalCheck,
 778                              CORSMode aCORSMode,
 779                              nsIPrincipal* aTriggeringPrincipal) {
 780   // If the entry's CORS mode doesn't match, or the CORS mode matches but the
 781   // document principal isn't the same, we can't use this request.
 782   if (aRequest->GetCORSMode() != aCORSMode) {
 783     return false;
 784   }
 785
 786   if (aRequest->GetCORSMode() != CORS_NONE || aForcePrincipalCheck) {
 787     nsCOMPtr<nsIPrincipal> otherprincipal = aRequest->GetTriggeringPrincipal();
 788
 789     // If we previously had a principal, but we don't now, we can't use this
 790     // request.
 791     if (otherprincipal && !aTriggeringPrincipal) {
 792       return false;
 793     }
 794
 795     if (otherprincipal && aTriggeringPrincipal &&
 796         !otherprincipal->Equals(aTriggeringPrincipal)) {
 797       return false;
 798     }
 799   }
 800
 801   return true;
 802 }
 803
 804 static bool ValidateSecurityInfo(imgRequest* aRequest,
 805                                  bool aForcePrincipalCheck, CORSMode aCORSMode,
 806                                  nsIPrincipal* aTriggeringPrincipal,
 807                                  Document* aLoadingDocument,
 808                                  nsContentPolicyType aPolicyType) {
 809   if (!ValidateCORSMode(aRequest, aForcePrincipalCheck, aCORSMode,
 810                         aTriggeringPrincipal)) {
 811     return false;
 812   }
 813   // Content Policy Check on Cached Images
 814   return ShouldLoadCachedImage(aRequest, aLoadingDocument, aTriggeringPrincipal,
 815                                aPolicyType,
 816                                /* aSendCSPViolationReports */ false);
 817 }
 818
 819 static nsresult NewImageChannel(
 820     nsIChannel** aResult,
 821     // If aForcePrincipalCheckForCacheEntry is true, then we will
 822     // force a principal check even when not using CORS before
 823     // assuming we have a cache hit on a cache entry that we
 824     // create for this channel.  This is an out param that should
 825     // be set to true if this channel ends up depending on
 826     // aTriggeringPrincipal and false otherwise.
 827     bool* aForcePrincipalCheckForCacheEntry, nsIURI* aURI,
 828     nsIURI* aInitialDocumentURI, CORSMode aCORSMode,
 829     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
 830     nsLoadFlags aLoadFlags, nsContentPolicyType aPolicyType,
 831     nsIPrincipal* aTriggeringPrincipal, nsINode* aRequestingNode,
 832     bool aRespectPrivacy, uint64_t aEarlyHintPreloaderId) {
 833   MOZ_ASSERT(aResult);
 834
 835   nsresult rv;
 836   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 837
 838   nsCOMPtr<nsIInterfaceRequestor> callbacks;
 839
 840   if (aLoadGroup) {
 841     // Get the notification callbacks from the load group for the new channel.
 842     //
 843     // XXX: This is not exactly correct, because the network request could be
 844     //      referenced by multiple windows...  However, the new channel needs
 845     //      something.  So, using the 'first' notification callbacks is better
 846     //      than nothing...
 847     //
 848     aLoadGroup->GetNotificationCallbacks(getter_AddRefs(callbacks));
 849   }
 850
 851   // Pass in a nullptr loadgroup because this is the underlying network
 852   // request. This request may be referenced by several proxy image requests
 853   // (possibly in different documents).
 854   // If all of the proxy requests are canceled then this request should be
 855   // canceled too.
 856   //
 857
 858   nsSecurityFlags securityFlags =
 859       nsContentSecurityManager::ComputeSecurityFlags(
 860           aCORSMode, nsContentSecurityManager::CORSSecurityMapping::
 861                          CORS_NONE_MAPS_TO_INHERITED_CONTEXT);
 862
 863   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 864
 865   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
 866   // node and a principal. This is for things like background images that are
 867   // specified by user stylesheets, where the document is being styled, but
 868   // the principal is that of the user stylesheet.
 869   if (aRequestingNode && aTriggeringPrincipal) {
 870     rv = NS_NewChannelWithTriggeringPrincipal(aResult, aURI, aRequestingNode,
 871                                               aTriggeringPrincipal,
 872                                               securityFlags, aPolicyType,
 873                                               nullptr,  // PerformanceStorage
 874                                               nullptr,  // loadGroup
 875                                               callbacks, aLoadFlags);
 876
 877     if (NS_FAILED(rv)) {
 878       return rv;
 879     }
 880
 881     if (aPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
 882       // If this is a favicon loading, we will use the originAttributes from the
 883       // triggeringPrincipal as the channel's originAttributes. This allows the
 884       // favicon loading from XUL will use the correct originAttributes.
 885
 886       nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 887       rv = loadInfo->SetOriginAttributes(
 888           aTriggeringPrincipal->OriginAttributesRef());
 889     }
 890   } else {
 891     // either we are loading something inside a document, in which case
 892     // we should always have a requestingNode, or we are loading something
 893     // outside a document, in which case the triggeringPrincipal and
 894     // triggeringPrincipal should always be the systemPrincipal.
 895     // However, there are exceptions: one is Notifications which create a
 896     // channel in the parent process in which case we can't get a
 897     // requestingNode.
 898     rv = NS_NewChannel(aResult, aURI, nsContentUtils::GetSystemPrincipal(),
 899                        securityFlags, aPolicyType,
 900                        nullptr,  // nsICookieJarSettings
 901                        nullptr,  // PerformanceStorage
 902                        nullptr,  // loadGroup
 903                        callbacks, aLoadFlags);
 904
 905     if (NS_FAILED(rv)) {
 906       return rv;
 907     }
 908
 909     // Use the OriginAttributes from the loading principal, if one is available,
 910     // and adjust the private browsing ID based on what kind of load the caller
 911     // has asked us to perform.
 912     OriginAttributes attrs;
 913     if (aTriggeringPrincipal) {
 914       attrs = aTriggeringPrincipal->OriginAttributesRef();
 915     }
 916     attrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
 917
 918     nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 919     rv = loadInfo->SetOriginAttributes(attrs);
 920   }
 921
 922   if (NS_FAILED(rv)) {
 923     return rv;
 924   }
 925
 926   // only inherit if we have a principal
 927   *aForcePrincipalCheckForCacheEntry =
 928       aTriggeringPrincipal && nsContentUtils::ChannelShouldInheritPrincipal(
 929                                   aTriggeringPrincipal, aURI,
 930                                   /* aInheritForAboutBlank */ false,
 931                                   /* aForceInherit */ false);
 932
 933   // Initialize HTTP-specific attributes
 934   newHttpChannel = do_QueryInterface(*aResult);
 935   if (newHttpChannel) {
 936     nsCOMPtr<nsIHttpChannelInternal> httpChannelInternal =
 937         do_QueryInterface(newHttpChannel);
 938     NS_ENSURE_TRUE(httpChannelInternal, NS_ERROR_UNEXPECTED);
 939     rv = httpChannelInternal->SetDocumentURI(aInitialDocumentURI);
 940     MOZ_ASSERT(NS_SUCCEEDED(rv));
 941     if (aReferrerInfo) {
 942       DebugOnly<nsresult> rv = newHttpChannel->SetReferrerInfo(aReferrerInfo);
 943       MOZ_ASSERT(NS_SUCCEEDED(rv));
 944     }
 945
 946     if (aEarlyHintPreloaderId) {
 947       rv = httpChannelInternal->SetEarlyHintPreloaderId(aEarlyHintPreloaderId);
 948       NS_ENSURE_SUCCESS(rv, rv);
 949     }
 950   }
 951
 952   // Image channels are loaded by default with reduced priority.
 953   nsCOMPtr<nsISupportsPriority> p = do_QueryInterface(*aResult);
 954   if (p) {
 955     uint32_t priority = nsISupportsPriority::PRIORITY_LOW;
 956
 957     if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
 958       ++priority;  // further reduce priority for background loads
 959     }
 960
 961     p->AdjustPriority(priority);
 962   }
 963
 964   // Create a new loadgroup for this new channel, using the old group as
 965   // the parent. The indirection keeps the channel insulated from cancels,
 966   // but does allow a way for this revalidation to be associated with at
 967   // least one base load group for scheduling/caching purposes.
 968
 969   nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
 970   nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
 971   if (childLoadGroup) {
 972     childLoadGroup->SetParentLoadGroup(aLoadGroup);
 973   }
 974   (*aResult)->SetLoadGroup(loadGroup);
 975
 976   return NS_OK;
 977 }
 978
 979 static uint32_t SecondsFromPRTime(PRTime aTime) {
 980   return nsContentUtils::SecondsFromPRTime(aTime);
 981 }
 982
 983 /* static */
 984 imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
 985                              bool forcePrincipalCheck)
 986     : mLoader(loader),
 987       mRequest(request),
 988       mDataSize(0),
 989       mTouchedTime(SecondsFromPRTime(PR_Now())),
 990       mLoadTime(SecondsFromPRTime(PR_Now())),
 991       mExpiryTime(0),
 992       mMustValidate(false),
 993       // We start off as evicted so we don't try to update the cache.
 994       // PutIntoCache will set this to false.
 995       mEvicted(true),
 996       mHasNoProxies(true),
 997       mForcePrincipalCheck(forcePrincipalCheck),
 998       mHasNotified(false) {}
 999
1000 imgCacheEntry::~imgCacheEntry() {
1001   LOG_FUNC(gImgLog, "imgCacheEntry::~imgCacheEntry()");
1002 }
1003
1004 void imgCacheEntry::Touch(bool updateTime /* = true */) {
1005   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
1006
1007   if (updateTime) {
1008     mTouchedTime = SecondsFromPRTime(PR_Now());
1009   }
1010
1011   UpdateCache();
1012 }
1013
1014 void imgCacheEntry::UpdateCache(int32_t diff /* = 0 */) {
1015   // Don't update the cache if we've been removed from it or it doesn't care
1016   // about our size or usage.
1017   if (!Evicted() && HasNoProxies()) {
1018     mLoader->CacheEntriesChanged(diff);
1019   }
1020 }
1021
1022 void imgCacheEntry::UpdateLoadTime() {
1023   mLoadTime = SecondsFromPRTime(PR_Now());
1024 }
1025
1026 void imgCacheEntry::SetHasNoProxies(bool hasNoProxies) {
1027   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1028     if (hasNoProxies) {
1029       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies true", "uri",
1030                           mRequest->CacheKey().URI());
1031     } else {
1032       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies false",
1033                           "uri", mRequest->CacheKey().URI());
1034     }
1035   }
1036
1037   mHasNoProxies = hasNoProxies;
1038 }
1039
1040 imgCacheQueue::imgCacheQueue() : mDirty(false), mSize(0) {}
1041
1042 void imgCacheQueue::UpdateSize(int32_t diff) { mSize += diff; }
1043
1044 uint32_t imgCacheQueue::GetSize() const { return mSize; }
1045
1046 void imgCacheQueue::Remove(imgCacheEntry* entry) {
1047   uint64_t index = mQueue.IndexOf(entry);
1048   if (index == queueContainer::NoIndex) {
1049     return;
1050   }
1051
1052   mSize -= mQueue[index]->GetDataSize();
1053
1054   // If the queue is clean and this is the first entry,
1055   // then we can efficiently remove the entry without
1056   // dirtying the sort order.
1057   if (!IsDirty() && index == 0) {
1058     std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1059     mQueue.RemoveLastElement();
1060     return;
1061   }
1062
1063   // Remove from the middle of the list.  This potentially
1064   // breaks the binary heap sort order.
1065   mQueue.RemoveElementAt(index);
1066
1067   // If we only have one entry or the queue is empty, though,
1068   // then the sort order is still effectively good.  Simply
1069   // refresh the list to clear the dirty flag.
1070   if (mQueue.Length() <= 1) {
1071     Refresh();
1072     return;
1073   }
1074
1075   // Otherwise we must mark the queue dirty and potentially
1076   // trigger an expensive sort later.
1077   MarkDirty();
1078 }
1079
1080 void imgCacheQueue::Push(imgCacheEntry* entry) {
1081   mSize += entry->GetDataSize();
1082
1083   RefPtr<imgCacheEntry> refptr(entry);
1084   mQueue.AppendElement(std::move(refptr));
1085   // If we're not dirty already, then we can efficiently add this to the
1086   // binary heap immediately.  This is only O(log n).
1087   if (!IsDirty()) {
1088     std::push_heap(mQueue.begin(), mQueue.end(),
1089                    imgLoader::CompareCacheEntries);
1090   }
1091 }
1092
1093 already_AddRefed<imgCacheEntry> imgCacheQueue::Pop() {
1094   if (mQueue.IsEmpty()) {
1095     return nullptr;
1096   }
1097   if (IsDirty()) {
1098     Refresh();
1099   }
1100
1101   std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1102   RefPtr<imgCacheEntry> entry = mQueue.PopLastElement();
1103
1104   mSize -= entry->GetDataSize();
1105   return entry.forget();
1106 }
1107
1108 void imgCacheQueue::Refresh() {
1109   // Resort the list.  This is an O(3 * n) operation and best avoided
1110   // if possible.
1111   std::make_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1112   mDirty = false;
1113 }
1114
1115 void imgCacheQueue::MarkDirty() { mDirty = true; }
1116
1117 bool imgCacheQueue::IsDirty() { return mDirty; }
1118
1119 uint32_t imgCacheQueue::GetNumElements() const { return mQueue.Length(); }
1120
1121 bool imgCacheQueue::Contains(imgCacheEntry* aEntry) const {
1122   return mQueue.Contains(aEntry);
1123 }
1124
1125 imgCacheQueue::iterator imgCacheQueue::begin() { return mQueue.begin(); }
1126
1127 imgCacheQueue::const_iterator imgCacheQueue::begin() const {
1128   return mQueue.begin();
1129 }
1130
1131 imgCacheQueue::iterator imgCacheQueue::end() { return mQueue.end(); }
1132
1133 imgCacheQueue::const_iterator imgCacheQueue::end() const {
1134   return mQueue.end();
1135 }
1136
1137 nsresult imgLoader::CreateNewProxyForRequest(
1138     imgRequest* aRequest, nsIURI* aURI, nsILoadGroup* aLoadGroup,
1139     Document* aLoadingDocument, imgINotificationObserver* aObserver,
1140     nsLoadFlags aLoadFlags, imgRequestProxy** _retval) {
1141   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::CreateNewProxyForRequest",
1142                        "imgRequest", aRequest);
1143
1144   /* XXX If we move decoding onto separate threads, we should save off the
1145      calling thread here and pass it off to |proxyRequest| so that it call
1146      proxy calls to |aObserver|.
1147    */
1148
1149   RefPtr<imgRequestProxy> proxyRequest = new imgRequestProxy();
1150
1151   /* It is important to call |SetLoadFlags()| before calling |Init()| because
1152      |Init()| adds the request to the loadgroup.
1153    */
1154   proxyRequest->SetLoadFlags(aLoadFlags);
1155
1156   // init adds itself to imgRequest's list of observers
1157   nsresult rv = proxyRequest->Init(aRequest, aLoadGroup, aLoadingDocument, aURI,
1158                                    aObserver);
1159   if (NS_WARN_IF(NS_FAILED(rv))) {
1160     return rv;
1161   }
1162
1163   proxyRequest.forget(_retval);
1164   return NS_OK;
1165 }
1166
1167 class imgCacheExpirationTracker final
1168     : public nsExpirationTracker<imgCacheEntry, 3> {
1169   enum { TIMEOUT_SECONDS = 10 };
1170
1171  public:
1172   imgCacheExpirationTracker();
1173
1174  protected:
1175   void NotifyExpired(imgCacheEntry* entry) override;
1176 };
1177
1178 imgCacheExpirationTracker::imgCacheExpirationTracker()
1179     : nsExpirationTracker<imgCacheEntry, 3>(TIMEOUT_SECONDS * 1000,
1180                                             "imgCacheExpirationTracker") {}
1181
1182 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry* entry) {
1183   // Hold on to a reference to this entry, because the expiration tracker
1184   // mechanism doesn't.
1185   RefPtr<imgCacheEntry> kungFuDeathGrip(entry);
1186
1187   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1188     RefPtr<imgRequest> req = entry->GetRequest();
1189     if (req) {
1190       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired",
1191                           "entry", req->CacheKey().URI());
1192     }
1193   }
1194
1195   // We can be called multiple times on the same entry. Don't do work multiple
1196   // times.
1197   if (!entry->Evicted()) {
1198     entry->Loader()->RemoveFromCache(entry);
1199   }
1200
1201   entry->Loader()->VerifyCacheSizes();
1202 }
1203
1204 ///////////////////////////////////////////////////////////////////////////////
1205 // imgLoader
1206 ///////////////////////////////////////////////////////////////////////////////
1207
1208 double imgLoader::sCacheTimeWeight;
1209 uint32_t imgLoader::sCacheMaxSize;
1210 imgMemoryReporter* imgLoader::sMemReporter;
1211
1212 NS_IMPL_ISUPPORTS(imgLoader, imgILoader, nsIContentSniffer, imgICache,
1213                   nsISupportsWeakReference, nsIObserver)
1214
1215 static imgLoader* gNormalLoader = nullptr;
1216 static imgLoader* gPrivateBrowsingLoader = nullptr;
1217
1218 /* static */
1219 already_AddRefed<imgLoader> imgLoader::CreateImageLoader() {
1220   // In some cases, such as xpctests, XPCOM modules are not automatically
1221   // initialized.  We need to make sure that our module is initialized before
1222   // we hand out imgLoader instances and code starts using them.
1223   mozilla::image::EnsureModuleInitialized();
1224
1225   RefPtr<imgLoader> loader = new imgLoader();
1226   loader->Init();
1227
1228   return loader.forget();
1229 }
1230
1231 imgLoader* imgLoader::NormalLoader() {
1232   if (!gNormalLoader) {
1233     gNormalLoader = CreateImageLoader().take();
1234   }
1235   return gNormalLoader;
1236 }
1237
1238 imgLoader* imgLoader::PrivateBrowsingLoader() {
1239   if (!gPrivateBrowsingLoader) {
1240     gPrivateBrowsingLoader = CreateImageLoader().take();
1241     gPrivateBrowsingLoader->RespectPrivacyNotifications();
1242   }
1243   return gPrivateBrowsingLoader;
1244 }
1245
1246 imgLoader::imgLoader()
1247     : mUncachedImagesMutex("imgLoader::UncachedImages"),
1248       mRespectPrivacy(false) {
1249   sMemReporter->AddRef();
1250   sMemReporter->RegisterLoader(this);
1251 }
1252
1253 imgLoader::~imgLoader() {
1254   ClearImageCache();
1255   {
1256     // If there are any of our imgRequest's left they are in the uncached
1257     // images set, so clear their pointer to us.
1258     MutexAutoLock lock(mUncachedImagesMutex);
1259     for (RefPtr<imgRequest> req : mUncachedImages) {
1260       req->ClearLoader();
1261     }
1262   }
1263   sMemReporter->UnregisterLoader(this);
1264   sMemReporter->Release();
1265 }
1266
1267 void imgLoader::VerifyCacheSizes() {
1268 #ifdef DEBUG
1269   if (!mCacheTracker) {
1270     return;
1271   }
1272
1273   uint32_t cachesize = mCache.Count();
1274   uint32_t queuesize = mCacheQueue.GetNumElements();
1275   uint32_t trackersize = 0;
1276   for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
1277        it.Next();) {
1278     trackersize++;
1279   }
1280   MOZ_ASSERT(queuesize == trackersize, "Queue and tracker sizes out of sync!");
1281   MOZ_ASSERT(queuesize <= cachesize, "Queue has more elements than cache!");
1282 #endif
1283 }
1284
1285 void imgLoader::GlobalInit() {
1286   sCacheTimeWeight = StaticPrefs::image_cache_timeweight_AtStartup() / 1000.0;
1287   int32_t cachesize = StaticPrefs::image_cache_size_AtStartup();
1288   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
1289
1290   sMemReporter = new imgMemoryReporter();
1291   RegisterStrongAsyncMemoryReporter(sMemReporter);
1292   RegisterImagesContentUsedUncompressedDistinguishedAmount(
1293       imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
1294 }
1295
1296 void imgLoader::ShutdownMemoryReporter() {
1297   UnregisterImagesContentUsedUncompressedDistinguishedAmount();
1298   UnregisterStrongMemoryReporter(sMemReporter);
1299 }
1300
1301 nsresult imgLoader::InitCache() {
1302   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
1303   if (!os) {
1304     return NS_ERROR_FAILURE;
1305   }
1306
1307   os->AddObserver(this, "memory-pressure", false);
1308   os->AddObserver(this, "chrome-flush-caches", false);
1309   os->AddObserver(this, "last-pb-context-exited", false);
1310   os->AddObserver(this, "profile-before-change", false);
1311   os->AddObserver(this, "xpcom-shutdown", false);
1312
1313   mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
1314
1315   return NS_OK;
1316 }
1317
1318 nsresult imgLoader::Init() {
1319   InitCache();
1320
1321   return NS_OK;
1322 }
1323
1324 NS_IMETHODIMP
1325 imgLoader::RespectPrivacyNotifications() {
1326   mRespectPrivacy = true;
1327   return NS_OK;
1328 }
1329
1330 NS_IMETHODIMP
1331 imgLoader::Observe(nsISupports* aSubject, const char* aTopic,
1332                    const char16_t* aData) {
1333   if (strcmp(aTopic, "memory-pressure") == 0) {
1334     MinimizeCache();
1335   } else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
1336     MinimizeCache();
1337     ClearImageCache({ClearOption::ChromeOnly});
1338   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
1339     if (mRespectPrivacy) {
1340       ClearImageCache();
1341     }
1342   } else if (strcmp(aTopic, "profile-before-change") == 0) {
1343     mCacheTracker = nullptr;
1344   } else if (strcmp(aTopic, "xpcom-shutdown") == 0) {
1345     mCacheTracker = nullptr;
1346     ShutdownMemoryReporter();
1347
1348   } else {
1349     // (Nothing else should bring us here)
1350     MOZ_ASSERT(0, "Invalid topic received");
1351   }
1352
1353   return NS_OK;
1354 }
1355
1356 NS_IMETHODIMP
1357 imgLoader::ClearCache(bool chrome) {
1358   if (XRE_IsParentProcess()) {
1359     bool privateLoader = this == gPrivateBrowsingLoader;
1360     for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1361       Unused << cp->SendClearImageCache(privateLoader, chrome);
1362     }
1363   }
1364   ClearOptions options;
1365   if (chrome) {
1366     options += ClearOption::ChromeOnly;
1367   }
1368   return ClearImageCache(options);
1369 }
1370
1371 NS_IMETHODIMP
1372 imgLoader::RemoveEntriesFromPrincipalInAllProcesses(nsIPrincipal* aPrincipal) {
1373   if (!XRE_IsParentProcess()) {
1374     return NS_ERROR_NOT_AVAILABLE;
1375   }
1376
1377   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1378     Unused << cp->SendClearImageCacheFromPrincipal(aPrincipal);
1379   }
1380
1381   imgLoader* loader;
1382   if (aPrincipal->OriginAttributesRef().mPrivateBrowsingId ==
1383       nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID) {
1384     loader = imgLoader::NormalLoader();
1385   } else {
1386     loader = imgLoader::PrivateBrowsingLoader();
1387   }
1388
1389   return loader->RemoveEntriesInternal(aPrincipal, nullptr);
1390 }
1391
1392 NS_IMETHODIMP
1393 imgLoader::RemoveEntriesFromBaseDomainInAllProcesses(
1394     const nsACString& aBaseDomain) {
1395   if (!XRE_IsParentProcess()) {
1396     return NS_ERROR_NOT_AVAILABLE;
1397   }
1398
1399   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1400     Unused << cp->SendClearImageCacheFromBaseDomain(aBaseDomain);
1401   }
1402
1403   return RemoveEntriesInternal(nullptr, &aBaseDomain);
1404 }
1405
1406 nsresult imgLoader::RemoveEntriesInternal(nsIPrincipal* aPrincipal,
1407                                           const nsACString* aBaseDomain) {
1408   // Can only clear by either principal or base domain.
1409   if ((!aPrincipal && !aBaseDomain) || (aPrincipal && aBaseDomain)) {
1410     return NS_ERROR_INVALID_ARG;
1411   }
1412
1413   nsAutoString origin;
1414   if (aPrincipal) {
1415     nsresult rv = nsContentUtils::GetUTFOrigin(aPrincipal, origin);
1416     if (NS_WARN_IF(NS_FAILED(rv))) {
1417       return rv;
1418     }
1419   }
1420
1421   nsCOMPtr<nsIEffectiveTLDService> tldService;
1422   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1423
1424   // For base domain we only clear the non-chrome cache.
1425   for (const auto& entry : mCache) {
1426     const auto& key = entry.GetKey();
1427
1428     const bool shouldRemove = [&] {
1429       if (aPrincipal) {
1430         if (key.OriginAttributesRef() !=
1431             BasePrincipal::Cast(aPrincipal)->OriginAttributesRef()) {
1432           return false;
1433         }
1434
1435         nsAutoString imageOrigin;
1436         nsresult rv = nsContentUtils::GetUTFOrigin(key.URI(), imageOrigin);
1437         if (NS_WARN_IF(NS_FAILED(rv))) {
1438           return false;
1439         }
1440
1441         return imageOrigin == origin;
1442       }
1443
1444       if (!aBaseDomain) {
1445         return false;
1446       }
1447       // Clear by baseDomain.
1448       nsAutoCString host;
1449       nsresult rv = key.URI()->GetHost(host);
1450       if (NS_FAILED(rv) || host.IsEmpty()) {
1451         return false;
1452       }
1453
1454       if (!tldService) {
1455         tldService = do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
1456       }
1457       if (NS_WARN_IF(!tldService)) {
1458         return false;
1459       }
1460
1461       bool hasRootDomain = false;
1462       rv = tldService->HasRootDomain(host, *aBaseDomain, &hasRootDomain);
1463       if (NS_SUCCEEDED(rv) && hasRootDomain) {
1464         return true;
1465       }
1466
1467       // If we don't get a direct base domain match, also check for cache of
1468       // third parties partitioned under aBaseDomain.
1469
1470       // The isolation key is either just the base domain, or an origin suffix
1471       // which contains the partitionKey holding the baseDomain.
1472
1473       if (key.IsolationKeyRef().Equals(*aBaseDomain)) {
1474         return true;
1475       }
1476
1477       // The isolation key does not match the given base domain. It may be an
1478       // origin suffix. Parse it into origin attributes.
1479       OriginAttributes attrs;
1480       if (!attrs.PopulateFromSuffix(key.IsolationKeyRef())) {
1481         // Key is not an origin suffix.
1482         return false;
1483       }
1484
1485       return StoragePrincipalHelper::PartitionKeyHasBaseDomain(
1486           attrs.mPartitionKey, *aBaseDomain);
1487     }();
1488
1489     if (shouldRemove) {
1490       entriesToBeRemoved.AppendElement(entry.GetData());
1491     }
1492   }
1493
1494   for (auto& entry : entriesToBeRemoved) {
1495     if (!RemoveFromCache(entry)) {
1496       NS_WARNING(
1497           "Couldn't remove an entry from the cache in "
1498           "RemoveEntriesInternal()\n");
1499     }
1500   }
1501
1502   return NS_OK;
1503 }
1504
1505 constexpr auto AllCORSModes() {
1506   return MakeInclusiveEnumeratedRange(kFirstCORSMode, kLastCORSMode);
1507 }
1508
1509 NS_IMETHODIMP
1510 imgLoader::RemoveEntry(nsIURI* aURI, Document* aDoc) {
1511   if (!aURI) {
1512     return NS_OK;
1513   }
1514   OriginAttributes attrs;
1515   if (aDoc) {
1516     attrs = aDoc->NodePrincipal()->OriginAttributesRef();
1517   }
1518   for (auto corsMode : AllCORSModes()) {
1519     ImageCacheKey key(aURI, corsMode, attrs, aDoc);
1520     RemoveFromCache(key);
1521   }
1522   return NS_OK;
1523 }
1524
1525 NS_IMETHODIMP
1526 imgLoader::FindEntryProperties(nsIURI* uri, Document* aDoc,
1527                                nsIProperties** _retval) {
1528   *_retval = nullptr;
1529
1530   OriginAttributes attrs;
1531   if (aDoc) {
1532     nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1533     if (principal) {
1534       attrs = principal->OriginAttributesRef();
1535     }
1536   }
1537
1538   for (auto corsMode : AllCORSModes()) {
1539     ImageCacheKey key(uri, corsMode, attrs, aDoc);
1540     RefPtr<imgCacheEntry> entry;
1541     if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
1542       continue;
1543     }
1544     if (mCacheTracker && entry->HasNoProxies()) {
1545       mCacheTracker->MarkUsed(entry);
1546     }
1547     RefPtr<imgRequest> request = entry->GetRequest();
1548     if (request) {
1549       nsCOMPtr<nsIProperties> properties = request->Properties();
1550       properties.forget(_retval);
1551       return NS_OK;
1552     }
1553   }
1554   return NS_OK;
1555 }
1556
1557 NS_IMETHODIMP_(void)
1558 imgLoader::ClearCacheForControlledDocument(Document* aDoc) {
1559   MOZ_ASSERT(aDoc);
1560   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1561   for (const auto& entry : mCache) {
1562     const auto& key = entry.GetKey();
1563     if (key.ControlledDocument() == aDoc) {
1564       entriesToBeRemoved.AppendElement(entry.GetData());
1565     }
1566   }
1567   for (auto& entry : entriesToBeRemoved) {
1568     if (!RemoveFromCache(entry)) {
1569       NS_WARNING(
1570           "Couldn't remove an entry from the cache in "
1571           "ClearCacheForControlledDocument()\n");
1572     }
1573   }
1574 }
1575
1576 void imgLoader::Shutdown() {
1577   NS_IF_RELEASE(gNormalLoader);
1578   gNormalLoader = nullptr;
1579   NS_IF_RELEASE(gPrivateBrowsingLoader);
1580   gPrivateBrowsingLoader = nullptr;
1581 }
1582
1583 bool imgLoader::PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* entry) {
1584   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::PutIntoCache", "uri",
1585                              aKey.URI());
1586
1587   // Check to see if this request already exists in the cache. If so, we'll
1588   // replace the old version.
1589   RefPtr<imgCacheEntry> tmpCacheEntry;
1590   if (mCache.Get(aKey, getter_AddRefs(tmpCacheEntry)) && tmpCacheEntry) {
1591     MOZ_LOG(
1592         gImgLog, LogLevel::Debug,
1593         ("[this=%p] imgLoader::PutIntoCache -- Element already in the cache",
1594          nullptr));
1595     RefPtr<imgRequest> tmpRequest = tmpCacheEntry->GetRequest();
1596
1597     // If it already exists, and we're putting the same key into the cache, we
1598     // should remove the old version.
1599     MOZ_LOG(gImgLog, LogLevel::Debug,
1600             ("[this=%p] imgLoader::PutIntoCache -- Replacing cached element",
1601              nullptr));
1602
1603     RemoveFromCache(aKey);
1604   } else {
1605     MOZ_LOG(gImgLog, LogLevel::Debug,
1606             ("[this=%p] imgLoader::PutIntoCache --"
1607              " Element NOT already in the cache",
1608              nullptr));
1609   }
1610
1611   mCache.InsertOrUpdate(aKey, RefPtr{entry});
1612
1613   // We can be called to resurrect an evicted entry.
1614   if (entry->Evicted()) {
1615     entry->SetEvicted(false);
1616   }
1617
1618   // If we're resurrecting an entry with no proxies, put it back in the
1619   // tracker and queue.
1620   if (entry->HasNoProxies()) {
1621     nsresult addrv = NS_OK;
1622
1623     if (mCacheTracker) {
1624       addrv = mCacheTracker->AddObject(entry);
1625     }
1626
1627     if (NS_SUCCEEDED(addrv)) {
1628       mCacheQueue.Push(entry);
1629     }
1630   }
1631
1632   RefPtr<imgRequest> request = entry->GetRequest();
1633   request->SetIsInCache(true);
1634   RemoveFromUncachedImages(request);
1635
1636   return true;
1637 }
1638
1639 bool imgLoader::SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry) {
1640   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasNoProxies", "uri",
1641                              aRequest->CacheKey().URI());
1642
1643   aEntry->SetHasNoProxies(true);
1644
1645   if (aEntry->Evicted()) {
1646     return false;
1647   }
1648
1649   nsresult addrv = NS_OK;
1650
1651   if (mCacheTracker) {
1652     addrv = mCacheTracker->AddObject(aEntry);
1653   }
1654
1655   if (NS_SUCCEEDED(addrv)) {
1656     mCacheQueue.Push(aEntry);
1657   }
1658
1659   return true;
1660 }
1661
1662 bool imgLoader::SetHasProxies(imgRequest* aRequest) {
1663   VerifyCacheSizes();
1664
1665   const ImageCacheKey& key = aRequest->CacheKey();
1666
1667   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasProxies", "uri",
1668                              key.URI());
1669
1670   RefPtr<imgCacheEntry> entry;
1671   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
1672     // Make sure the cache entry is for the right request
1673     RefPtr<imgRequest> entryRequest = entry->GetRequest();
1674     if (entryRequest == aRequest && entry->HasNoProxies()) {
1675       mCacheQueue.Remove(entry);
1676
1677       if (mCacheTracker) {
1678         mCacheTracker->RemoveObject(entry);
1679       }
1680
1681       entry->SetHasNoProxies(false);
1682
1683       return true;
1684     }
1685   }
1686
1687   return false;
1688 }
1689
1690 void imgLoader::CacheEntriesChanged(int32_t aSizeDiff /* = 0 */) {
1691   // We only need to dirty the queue if there is any sorting
1692   // taking place.  Empty or single-entry lists can't become
1693   // dirty.
1694   if (mCacheQueue.GetNumElements() > 1) {
1695     mCacheQueue.MarkDirty();
1696   }
1697   mCacheQueue.UpdateSize(aSizeDiff);
1698 }
1699
1700 void imgLoader::CheckCacheLimits() {
1701   if (mCacheQueue.GetNumElements() == 0) {
1702     NS_ASSERTION(mCacheQueue.GetSize() == 0,
1703                  "imgLoader::CheckCacheLimits -- incorrect cache size");
1704   }
1705
1706   // Remove entries from the cache until we're back at our desired max size.
1707   while (mCacheQueue.GetSize() > sCacheMaxSize) {
1708     // Remove the first entry in the queue.
1709     RefPtr<imgCacheEntry> entry(mCacheQueue.Pop());
1710
1711     NS_ASSERTION(entry, "imgLoader::CheckCacheLimits -- NULL entry pointer");
1712
1713     if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1714       RefPtr<imgRequest> req = entry->GetRequest();
1715       if (req) {
1716         LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits",
1717                                    "entry", req->CacheKey().URI());
1718       }
1719     }
1720
1721     if (entry) {
1722       // We just popped this entry from the queue, so pass AlreadyRemoved
1723       // to avoid searching the queue again in RemoveFromCache.
1724       RemoveFromCache(entry, QueueState::AlreadyRemoved);
1725     }
1726   }
1727 }
1728
1729 bool imgLoader::ValidateRequestWithNewChannel(
1730     imgRequest* request, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1731     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1732     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1733     uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
1734     nsContentPolicyType aLoadPolicyType, imgRequestProxy** aProxyRequest,
1735     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode, bool aLinkPreload,
1736     uint64_t aEarlyHintPreloaderId, bool* aNewChannelCreated) {
1737   // now we need to insert a new channel request object in between the real
1738   // request and the proxy that basically delays loading the image until it
1739   // gets a 304 or figures out that this needs to be a new request
1740
1741   nsresult rv;
1742
1743   // If we're currently in the middle of validating this request, just hand
1744   // back a proxy to it; the required work will be done for us.
1745   if (imgCacheValidator* validator = request->GetValidator()) {
1746     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1747                                   aObserver, aLoadFlags, aProxyRequest);
1748     if (NS_FAILED(rv)) {
1749       return false;
1750     }
1751
1752     if (*aProxyRequest) {
1753       imgRequestProxy* proxy = static_cast<imgRequestProxy*>(*aProxyRequest);
1754
1755       // We will send notifications from imgCacheValidator::OnStartRequest().
1756       // In the mean time, we must defer notifications because we are added to
1757       // the imgRequest's proxy list, and we can get extra notifications
1758       // resulting from methods such as StartDecoding(). See bug 579122.
1759       proxy->MarkValidating();
1760
1761       if (aLinkPreload) {
1762         MOZ_ASSERT(aLoadingDocument);
1763         proxy->PrioritizeAsPreload();
1764         auto preloadKey = PreloadHashKey::CreateAsImage(
1765             aURI, aTriggeringPrincipal, aCORSMode);
1766         proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
1767       }
1768
1769       // Attach the proxy without notifying
1770       validator->AddProxy(proxy);
1771     }
1772
1773     return true;
1774   }
1775   // We will rely on Necko to cache this request when it's possible, and to
1776   // tell imgCacheValidator::OnStartRequest whether the request came from its
1777   // cache.
1778   nsCOMPtr<nsIChannel> newChannel;
1779   bool forcePrincipalCheck;
1780   rv =
1781       NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
1782                       aInitialDocumentURI, aCORSMode, aReferrerInfo, aLoadGroup,
1783                       aLoadFlags, aLoadPolicyType, aTriggeringPrincipal,
1784                       aLoadingDocument, mRespectPrivacy, aEarlyHintPreloaderId);
1785   if (NS_FAILED(rv)) {
1786     return false;
1787   }
1788
1789   if (aNewChannelCreated) {
1790     *aNewChannelCreated = true;
1791   }
1792
1793   RefPtr<imgRequestProxy> req;
1794   rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1795                                 aObserver, aLoadFlags, getter_AddRefs(req));
1796   if (NS_FAILED(rv)) {
1797     return false;
1798   }
1799
1800   // Make sure that OnStatus/OnProgress calls have the right request set...
1801   RefPtr<nsProgressNotificationProxy> progressproxy =
1802       new nsProgressNotificationProxy(newChannel, req);
1803   if (!progressproxy) {
1804     return false;
1805   }
1806
1807   RefPtr<imgCacheValidator> hvc =
1808       new imgCacheValidator(progressproxy, this, request, aLoadingDocument,
1809                             aInnerWindowId, forcePrincipalCheck);
1810
1811   // Casting needed here to get past multiple inheritance.
1812   nsCOMPtr<nsIStreamListener> listener =
1813       do_QueryInterface(static_cast<nsIThreadRetargetableStreamListener*>(hvc));
1814   NS_ENSURE_TRUE(listener, false);
1815
1816   // We must set the notification callbacks before setting up the
1817   // CORS listener, because that's also interested inthe
1818   // notification callbacks.
1819   newChannel->SetNotificationCallbacks(hvc);
1820
1821   request->SetValidator(hvc);
1822
1823   // We will send notifications from imgCacheValidator::OnStartRequest().
1824   // In the mean time, we must defer notifications because we are added to
1825   // the imgRequest's proxy list, and we can get extra notifications
1826   // resulting from methods such as StartDecoding(). See bug 579122.
1827   req->MarkValidating();
1828
1829   if (aLinkPreload) {
1830     MOZ_ASSERT(aLoadingDocument);
1831     req->PrioritizeAsPreload();
1832     auto preloadKey =
1833         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, aCORSMode);
1834     req->NotifyOpen(preloadKey, aLoadingDocument, true);
1835   }
1836
1837   // Add the proxy without notifying
1838   hvc->AddProxy(req);
1839
1840   mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
1841                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
1842                                aLoadGroup);
1843   rv = newChannel->AsyncOpen(listener);
1844   if (NS_WARN_IF(NS_FAILED(rv))) {
1845     req->CancelAndForgetObserver(rv);
1846     // This will notify any current or future <link preload> tags.  Pass the
1847     // non-open channel so that we can read loadinfo and referrer info of that
1848     // channel.
1849     req->NotifyStart(newChannel);
1850     // Use the non-channel overload of this method to force the notification to
1851     // happen.  The preload request has not been assigned a channel.
1852     req->NotifyStop(rv);
1853     return false;
1854   }
1855
1856   req.forget(aProxyRequest);
1857   return true;
1858 }
1859
1860 void imgLoader::NotifyObserversForCachedImage(
1861     imgCacheEntry* aEntry, imgRequest* request, nsIURI* aURI,
1862     nsIReferrerInfo* aReferrerInfo, Document* aLoadingDocument,
1863     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode,
1864     uint64_t aEarlyHintPreloaderId) {
1865   if (aEntry->HasNotified()) {
1866     return;
1867   }
1868
1869   nsCOMPtr<nsIObserverService> obsService = services::GetObserverService();
1870
1871   if (!obsService->HasObservers("http-on-image-cache-response")) {
1872     return;
1873   }
1874
1875   aEntry->SetHasNotified();
1876
1877   nsCOMPtr<nsIChannel> newChannel;
1878   bool forcePrincipalCheck;
1879   nsresult rv = NewImageChannel(
1880       getter_AddRefs(newChannel), &forcePrincipalCheck, aURI, nullptr,
1881       aCORSMode, aReferrerInfo, nullptr, 0,
1882       nsIContentPolicy::TYPE_INTERNAL_IMAGE, aTriggeringPrincipal,
1883       aLoadingDocument, mRespectPrivacy, aEarlyHintPreloaderId);
1884   if (NS_FAILED(rv)) {
1885     return;
1886   }
1887
1888   RefPtr<HttpBaseChannel> httpBaseChannel = do_QueryObject(newChannel);
1889   if (httpBaseChannel) {
1890     httpBaseChannel->SetDummyChannelForImageCache();
1891     newChannel->SetContentType(nsDependentCString(request->GetMimeType()));
1892     RefPtr<mozilla::image::Image> image = request->GetImage();
1893     if (image) {
1894       newChannel->SetContentLength(aEntry->GetDataSize());
1895     }
1896     obsService->NotifyObservers(newChannel, "http-on-image-cache-response",
1897                                 nullptr);
1898   }
1899 }
1900
1901 bool imgLoader::ValidateEntry(
1902     imgCacheEntry* aEntry, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1903     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1904     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1905     nsLoadFlags aLoadFlags, nsContentPolicyType aLoadPolicyType,
1906     bool aCanMakeNewChannel, bool* aNewChannelCreated,
1907     imgRequestProxy** aProxyRequest, nsIPrincipal* aTriggeringPrincipal,
1908     CORSMode aCORSMode, bool aLinkPreload, uint64_t aEarlyHintPreloaderId) {
1909   LOG_SCOPE(gImgLog, "imgLoader::ValidateEntry");
1910
1911   // If the expiration time is zero, then the request has not gotten far enough
1912   // to know when it will expire, or we know it will never expire (see
1913   // nsContentUtils::GetSubresourceCacheValidationInfo).
1914   uint32_t expiryTime = aEntry->GetExpiryTime();
1915   bool hasExpired = expiryTime && expiryTime <= SecondsFromPRTime(PR_Now());
1916
1917   nsresult rv;
1918
1919   // Special treatment for file URLs - aEntry has expired if file has changed
1920   nsCOMPtr<nsIFileURL> fileUrl(do_QueryInterface(aURI));
1921   if (fileUrl) {
1922     uint32_t lastModTime = aEntry->GetLoadTime();
1923
1924     nsCOMPtr<nsIFile> theFile;
1925     rv = fileUrl->GetFile(getter_AddRefs(theFile));
1926     if (NS_SUCCEEDED(rv)) {
1927       PRTime fileLastMod;
1928       rv = theFile->GetLastModifiedTime(&fileLastMod);
1929       if (NS_SUCCEEDED(rv)) {
1930         // nsIFile uses millisec, NSPR usec
1931         fileLastMod *= 1000;
1932         hasExpired = SecondsFromPRTime((PRTime)fileLastMod) > lastModTime;
1933       }
1934     }
1935   }
1936
1937   RefPtr<imgRequest> request(aEntry->GetRequest());
1938
1939   if (!request) {
1940     return false;
1941   }
1942
1943   if (!ValidateSecurityInfo(request, aEntry->ForcePrincipalCheck(), aCORSMode,
1944                             aTriggeringPrincipal, aLoadingDocument,
1945                             aLoadPolicyType)) {
1946     return false;
1947   }
1948
1949   // data URIs are immutable and by their nature can't leak data, so we can
1950   // just return true in that case.  Doing so would mean that shift-reload
1951   // doesn't reload data URI documents/images though (which is handy for
1952   // debugging during gecko development) so we make an exception in that case.
1953   if (aURI->SchemeIs("data") && !(aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE)) {
1954     return true;
1955   }
1956
1957   bool validateRequest = false;
1958
1959   if (!request->CanReuseWithoutValidation(aLoadingDocument)) {
1960     // If we would need to revalidate this entry, but we're being told to
1961     // bypass the cache, we don't allow this entry to be used.
1962     if (aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE) {
1963       return false;
1964     }
1965
1966     if (MOZ_UNLIKELY(ChaosMode::isActive(ChaosFeature::ImageCache))) {
1967       if (ChaosMode::randomUint32LessThan(4) < 1) {
1968         return false;
1969       }
1970     }
1971
1972     // Determine whether the cache aEntry must be revalidated...
1973     validateRequest = ShouldRevalidateEntry(aEntry, aLoadFlags, hasExpired);
1974
1975     MOZ_LOG(gImgLog, LogLevel::Debug,
1976             ("imgLoader::ValidateEntry validating cache entry. "
1977              "validateRequest = %d",
1978              validateRequest));
1979   } else if (!aLoadingDocument && MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1980     MOZ_LOG(gImgLog, LogLevel::Debug,
1981             ("imgLoader::ValidateEntry BYPASSING cache validation for %s "
1982              "because of NULL loading document",
1983              aURI->GetSpecOrDefault().get()));
1984   }
1985
1986   // If the original request is still transferring don't kick off a validation
1987   // network request because it is a bit silly to issue a validation request if
1988   // the original request hasn't even finished yet. So just return true
1989   // indicating the caller can create a new proxy for the request and use it as
1990   // is.
1991   // This is an optimization but it's also required for correctness. If we don't
1992   // do this then when firing the load complete notification for the original
1993   // request that can unblock load for the document and then spin the event loop
1994   // (see the stack in bug 1641682) which then the OnStartRequest for the
1995   // validation request can fire which can call UpdateProxies and can sync
1996   // notify on the progress tracker about all existing state, which includes
1997   // load complete, so we fire a second load complete notification for the
1998   // image.
1999   // In addition, we want to validate if the original request encountered
2000   // an error for two reasons. The first being if the error was a network error
2001   // then trying to re-fetch the image might succeed. The second is more
2002   // complicated. We decide if we should fire the load or error event for img
2003   // elements depending on if the image has error in its status at the time when
2004   // the load complete notification is received, and we set error status on an
2005   // image if it encounters a network error or a decode error with no real way
2006   // to tell them apart. So if we load an image that will produce a decode error
2007   // the first time we will usually fire the load event, and then decode enough
2008   // to encounter the decode error and set the error status on the image. The
2009   // next time we reference the image in the same document the load complete
2010   // notification is replayed and this time the error status from the decode is
2011   // already present so we fire the error event instead of the load event. This
2012   // is a bug (bug 1645576) that we should fix. In order to avoid that bug in
2013   // some cases (specifically the cases when we hit this code and try to
2014   // validate the request) we make sure to validate. This avoids the bug because
2015   // when the load complete notification arrives the proxy is marked as
2016   // validating so it lies about its status and returns nothing.
2017   bool requestComplete = false;
2018   RefPtr<ProgressTracker> tracker;
2019   RefPtr<mozilla::image::Image> image = request->GetImage();
2020   if (image) {
2021     tracker = image->GetProgressTracker();
2022   } else {
2023     tracker = request->GetProgressTracker();
2024   }
2025   if (tracker) {
2026     if (tracker->GetProgress() & (FLAG_LOAD_COMPLETE | FLAG_HAS_ERROR)) {
2027       requestComplete = true;
2028     }
2029   }
2030   if (!requestComplete) {
2031     return true;
2032   }
2033
2034   if (validateRequest && aCanMakeNewChannel) {
2035     LOG_SCOPE(gImgLog, "imgLoader::ValidateRequest |cache hit| must validate");
2036
2037     uint64_t innerWindowID =
2038         aLoadingDocument ? aLoadingDocument->InnerWindowID() : 0;
2039     return ValidateRequestWithNewChannel(
2040         request, aURI, aInitialDocumentURI, aReferrerInfo, aLoadGroup,
2041         aObserver, aLoadingDocument, innerWindowID, aLoadFlags, aLoadPolicyType,
2042         aProxyRequest, aTriggeringPrincipal, aCORSMode, aLinkPreload,
2043         aEarlyHintPreloaderId, aNewChannelCreated);
2044   }
2045
2046   if (!validateRequest) {
2047     NotifyObserversForCachedImage(aEntry, request, aURI, aReferrerInfo,
2048                                   aLoadingDocument, aTriggeringPrincipal,
2049                                   aCORSMode, aEarlyHintPreloaderId);
2050   }
2051
2052   return !validateRequest;
2053 }
2054
2055 bool imgLoader::RemoveFromCache(const ImageCacheKey& aKey) {
2056   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache", "uri",
2057                              aKey.URI());
2058   RefPtr<imgCacheEntry> entry;
2059   mCache.Remove(aKey, getter_AddRefs(entry));
2060   if (entry) {
2061     MOZ_ASSERT(!entry->Evicted(), "Evicting an already-evicted cache entry!");
2062
2063     // Entries with no proxies are in the tracker.
2064     if (entry->HasNoProxies()) {
2065       if (mCacheTracker) {
2066         mCacheTracker->RemoveObject(entry);
2067       }
2068       mCacheQueue.Remove(entry);
2069     }
2070
2071     entry->SetEvicted(true);
2072
2073     RefPtr<imgRequest> request = entry->GetRequest();
2074     request->SetIsInCache(false);
2075     AddToUncachedImages(request);
2076
2077     return true;
2078   }
2079   return false;
2080 }
2081
2082 bool imgLoader::RemoveFromCache(imgCacheEntry* entry, QueueState aQueueState) {
2083   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
2084
2085   RefPtr<imgRequest> request = entry->GetRequest();
2086   if (request) {
2087     const ImageCacheKey& key = request->CacheKey();
2088     LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache",
2089                                "entry's uri", key.URI());
2090
2091     mCache.Remove(key);
2092
2093     if (entry->HasNoProxies()) {
2094       LOG_STATIC_FUNC(gImgLog,
2095                       "imgLoader::RemoveFromCache removing from tracker");
2096       if (mCacheTracker) {
2097         mCacheTracker->RemoveObject(entry);
2098       }
2099       // Only search the queue to remove the entry if its possible it might
2100       // be in the queue.  If we know its not in the queue this would be
2101       // wasted work.
2102       MOZ_ASSERT_IF(aQueueState == QueueState::AlreadyRemoved,
2103                     !mCacheQueue.Contains(entry));
2104       if (aQueueState == QueueState::MaybeExists) {
2105         mCacheQueue.Remove(entry);
2106       }
2107     }
2108
2109     entry->SetEvicted(true);
2110     request->SetIsInCache(false);
2111     AddToUncachedImages(request);
2112
2113     return true;
2114   }
2115
2116   return false;
2117 }
2118
2119 nsresult imgLoader::ClearImageCache(ClearOptions aOptions) {
2120   const bool chromeOnly = aOptions.contains(ClearOption::ChromeOnly);
2121   const auto ShouldRemove = [&](imgCacheEntry* aEntry) {
2122     if (chromeOnly) {
2123       // TODO: Consider also removing "resource://" etc?
2124       RefPtr<imgRequest> request = aEntry->GetRequest();
2125       if (!request || !request->CacheKey().URI()->SchemeIs("chrome")) {
2126         return false;
2127       }
2128     }
2129     return true;
2130   };
2131   if (aOptions.contains(ClearOption::UnusedOnly)) {
2132     LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache queue");
2133     // We have to make a temporary, since RemoveFromCache removes the element
2134     // from the queue, invalidating iterators.
2135     nsTArray<RefPtr<imgCacheEntry>> entries(mCacheQueue.GetNumElements());
2136     for (auto& entry : mCacheQueue) {
2137       if (ShouldRemove(entry)) {
2138         entries.AppendElement(entry);
2139       }
2140     }
2141
2142     // Iterate in reverse order to minimize array copying.
2143     for (auto& entry : entries) {
2144       if (!RemoveFromCache(entry)) {
2145         return NS_ERROR_FAILURE;
2146       }
2147     }
2148
2149     MOZ_ASSERT(chromeOnly || mCacheQueue.GetNumElements() == 0);
2150     return NS_OK;
2151   }
2152
2153   LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache table");
2154   // We have to make a temporary, since RemoveFromCache removes the element
2155   // from the queue, invalidating iterators.
2156   const auto entries =
2157       ToTArray<nsTArray<RefPtr<imgCacheEntry>>>(mCache.Values());
2158   for (const auto& entry : entries) {
2159     if (!ShouldRemove(entry)) {
2160       continue;
2161     }
2162     if (!RemoveFromCache(entry)) {
2163       return NS_ERROR_FAILURE;
2164     }
2165   }
2166   MOZ_ASSERT(chromeOnly || mCache.IsEmpty());
2167   return NS_OK;
2168 }
2169
2170 void imgLoader::AddToUncachedImages(imgRequest* aRequest) {
2171   MutexAutoLock lock(mUncachedImagesMutex);
2172   mUncachedImages.Insert(aRequest);
2173 }
2174
2175 void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest) {
2176   MutexAutoLock lock(mUncachedImagesMutex);
2177   mUncachedImages.Remove(aRequest);
2178 }
2179
2180 #define LOAD_FLAGS_CACHE_MASK \
2181   (nsIRequest::LOAD_BYPASS_CACHE | nsIRequest::LOAD_FROM_CACHE)
2182
2183 #define LOAD_FLAGS_VALIDATE_MASK                              \
2184   (nsIRequest::VALIDATE_ALWAYS | nsIRequest::VALIDATE_NEVER | \
2185    nsIRequest::VALIDATE_ONCE_PER_SESSION)
2186
2187 NS_IMETHODIMP
2188 imgLoader::LoadImageXPCOM(
2189     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2190     nsIPrincipal* aTriggeringPrincipal, nsILoadGroup* aLoadGroup,
2191     imgINotificationObserver* aObserver, Document* aLoadingDocument,
2192     nsLoadFlags aLoadFlags, nsISupports* aCacheKey,
2193     nsContentPolicyType aContentPolicyType, imgIRequest** _retval) {
2194   // Optional parameter, so defaults to 0 (== TYPE_INVALID)
2195   if (!aContentPolicyType) {
2196     aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE;
2197   }
2198   imgRequestProxy* proxy;
2199   nsresult rv =
2200       LoadImage(aURI, aInitialDocumentURI, aReferrerInfo, aTriggeringPrincipal,
2201                 0, aLoadGroup, aObserver, aLoadingDocument, aLoadingDocument,
2202                 aLoadFlags, aCacheKey, aContentPolicyType, u""_ns,
2203                 /* aUseUrgentStartForChannel */ false, /* aListPreload */ false,
2204                 0, &proxy);
2205   *_retval = proxy;
2206   return rv;
2207 }
2208
2209 static void MakeRequestStaticIfNeeded(
2210     Document* aLoadingDocument, imgRequestProxy** aProxyAboutToGetReturned) {
2211   if (!aLoadingDocument || !aLoadingDocument->IsStaticDocument()) {
2212     return;
2213   }
2214
2215   if (!*aProxyAboutToGetReturned) {
2216     return;
2217   }
2218
2219   RefPtr<imgRequestProxy> proxy = dont_AddRef(*aProxyAboutToGetReturned);
2220   *aProxyAboutToGetReturned = nullptr;
2221
2222   RefPtr<imgRequestProxy> staticProxy =
2223       proxy->GetStaticRequest(aLoadingDocument);
2224   if (staticProxy != proxy) {
2225     proxy->CancelAndForgetObserver(NS_BINDING_ABORTED);
2226     proxy = std::move(staticProxy);
2227   }
2228   proxy.forget(aProxyAboutToGetReturned);
2229 }
2230
2231 bool imgLoader::IsImageAvailable(nsIURI* aURI,
2232                                  nsIPrincipal* aTriggeringPrincipal,
2233                                  CORSMode aCORSMode, Document* aDocument) {
2234   ImageCacheKey key(aURI, aCORSMode,
2235                     aTriggeringPrincipal->OriginAttributesRef(), aDocument);
2236   RefPtr<imgCacheEntry> entry;
2237   if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
2238     return false;
2239   }
2240   RefPtr<imgRequest> request = entry->GetRequest();
2241   if (!request) {
2242     return false;
2243   }
2244   if (nsCOMPtr<nsILoadGroup> docLoadGroup = aDocument->GetDocumentLoadGroup()) {
2245     nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2246     docLoadGroup->GetLoadFlags(&requestFlags);
2247     if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2248       // If we're bypassing the cache, treat the image as not available.
2249       return false;
2250     }
2251   }
2252   return ValidateCORSMode(request, false, aCORSMode, aTriggeringPrincipal);
2253 }
2254
2255 nsresult imgLoader::LoadImage(
2256     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2257     nsIPrincipal* aTriggeringPrincipal, uint64_t aRequestContextID,
2258     nsILoadGroup* aLoadGroup, imgINotificationObserver* aObserver,
2259     nsINode* aContext, Document* aLoadingDocument, nsLoadFlags aLoadFlags,
2260     nsISupports* aCacheKey, nsContentPolicyType aContentPolicyType,
2261     const nsAString& initiatorType, bool aUseUrgentStartForChannel,
2262     bool aLinkPreload, uint64_t aEarlyHintPreloaderId,
2263     imgRequestProxy** _retval) {
2264   VerifyCacheSizes();
2265
2266   NS_ASSERTION(aURI, "imgLoader::LoadImage -- NULL URI pointer");
2267
2268   if (!aURI) {
2269     return NS_ERROR_NULL_POINTER;
2270   }
2271
2272   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2273       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2274
2275   AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("imgLoader::LoadImage", NETWORK,
2276                                         aURI->GetSpecOrDefault());
2277
2278   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::LoadImage", "aURI", aURI);
2279
2280   *_retval = nullptr;
2281
2282   RefPtr<imgRequest> request;
2283
2284   nsresult rv;
2285   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2286
2287 #ifdef DEBUG
2288   bool isPrivate = false;
2289
2290   if (aLoadingDocument) {
2291     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadingDocument);
2292   } else if (aLoadGroup) {
2293     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadGroup);
2294   }
2295   MOZ_ASSERT(isPrivate == mRespectPrivacy);
2296
2297   if (aLoadingDocument) {
2298     // The given load group should match that of the document if given. If
2299     // that isn't the case, then we need to add more plumbing to ensure we
2300     // block the document as well.
2301     nsCOMPtr<nsILoadGroup> docLoadGroup =
2302         aLoadingDocument->GetDocumentLoadGroup();
2303     MOZ_ASSERT(docLoadGroup == aLoadGroup);
2304   }
2305 #endif
2306
2307   // Get the default load flags from the loadgroup (if possible)...
2308   if (aLoadGroup) {
2309     aLoadGroup->GetLoadFlags(&requestFlags);
2310   }
2311   //
2312   // Merge the default load flags with those passed in via aLoadFlags.
2313   // Currently, *only* the caching, validation and background load flags
2314   // are merged...
2315   //
2316   // The flags in aLoadFlags take precedence over the default flags!
2317   //
2318   if (aLoadFlags & LOAD_FLAGS_CACHE_MASK) {
2319     // Override the default caching flags...
2320     requestFlags = (requestFlags & ~LOAD_FLAGS_CACHE_MASK) |
2321                    (aLoadFlags & LOAD_FLAGS_CACHE_MASK);
2322   }
2323   if (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK) {
2324     // Override the default validation flags...
2325     requestFlags = (requestFlags & ~LOAD_FLAGS_VALIDATE_MASK) |
2326                    (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK);
2327   }
2328   if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
2329     // Propagate background loading...
2330     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2331   }
2332   if (aLoadFlags & nsIRequest::LOAD_RECORD_START_REQUEST_DELAY) {
2333     requestFlags |= nsIRequest::LOAD_RECORD_START_REQUEST_DELAY;
2334   }
2335
2336   if (aLinkPreload) {
2337     // Set background loading if it is <link rel=preload>
2338     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2339   }
2340
2341   CORSMode corsmode = CORS_NONE;
2342   if (aLoadFlags & imgILoader::LOAD_CORS_ANONYMOUS) {
2343     corsmode = CORS_ANONYMOUS;
2344   } else if (aLoadFlags & imgILoader::LOAD_CORS_USE_CREDENTIALS) {
2345     corsmode = CORS_USE_CREDENTIALS;
2346   }
2347
2348   // Look in the preloaded images of loading document first.
2349   if (StaticPrefs::network_preload() && !aLinkPreload && aLoadingDocument) {
2350     // All Early Hints preloads are Link preloads, therefore we don't have a
2351     // Early Hints preload here
2352     MOZ_ASSERT(!aEarlyHintPreloaderId);
2353     auto key =
2354         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2355     if (RefPtr<PreloaderBase> preload =
2356             aLoadingDocument->Preloads().LookupPreload(key)) {
2357       RefPtr<imgRequestProxy> proxy = do_QueryObject(preload);
2358       MOZ_ASSERT(proxy);
2359
2360       MOZ_LOG(gImgLog, LogLevel::Debug,
2361               ("[this=%p] imgLoader::LoadImage -- preloaded [proxy=%p]"
2362                " [document=%p]\n",
2363                this, proxy.get(), aLoadingDocument));
2364
2365       // Removing the preload for this image to be in parity with Chromium.  Any
2366       // following regular image request will be reloaded using the regular
2367       // path: image cache, http cache, network.  Any following `<link
2368       // rel=preload as=image>` will start a new image preload that can be
2369       // satisfied from http cache or network.
2370       //
2371       // There is a spec discussion for "preload cache", see
2372       // https://github.com/w3c/preload/issues/97. And it is also not clear how
2373       // preload image interacts with list of available images, see
2374       // https://github.com/whatwg/html/issues/4474.
2375       proxy->RemoveSelf(aLoadingDocument);
2376       proxy->NotifyUsage(aLoadingDocument);
2377
2378       imgRequest* request = proxy->GetOwner();
2379       nsresult rv =
2380           CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2381                                    aObserver, requestFlags, _retval);
2382       NS_ENSURE_SUCCESS(rv, rv);
2383
2384       imgRequestProxy* newProxy = *_retval;
2385       if (imgCacheValidator* validator = request->GetValidator()) {
2386         newProxy->MarkValidating();
2387         // Attach the proxy without notifying and this will add us to the load
2388         // group.
2389         validator->AddProxy(newProxy);
2390       } else {
2391         // It's OK to add here even if the request is done. If it is, it'll send
2392         // a OnStopRequest()and the proxy will be removed from the loadgroup in
2393         // imgRequestProxy::OnLoadComplete.
2394         newProxy->AddToLoadGroup();
2395         newProxy->NotifyListener();
2396       }
2397
2398       return NS_OK;
2399     }
2400   }
2401
2402   RefPtr<imgCacheEntry> entry;
2403
2404   // Look in the cache for our URI, and then validate it.
2405   // XXX For now ignore aCacheKey. We will need it in the future
2406   // for correctly dealing with image load requests that are a result
2407   // of post data.
2408   OriginAttributes attrs;
2409   if (aTriggeringPrincipal) {
2410     attrs = aTriggeringPrincipal->OriginAttributesRef();
2411   }
2412   ImageCacheKey key(aURI, corsmode, attrs, aLoadingDocument);
2413   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2414     bool newChannelCreated = false;
2415     if (ValidateEntry(entry, aURI, aInitialDocumentURI, aReferrerInfo,
2416                       aLoadGroup, aObserver, aLoadingDocument, requestFlags,
2417                       aContentPolicyType, true, &newChannelCreated, _retval,
2418                       aTriggeringPrincipal, corsmode, aLinkPreload,
2419                       aEarlyHintPreloaderId)) {
2420       request = entry->GetRequest();
2421
2422       // If this entry has no proxies, its request has no reference to the
2423       // entry.
2424       if (entry->HasNoProxies()) {
2425         LOG_FUNC_WITH_PARAM(gImgLog,
2426                             "imgLoader::LoadImage() adding proxyless entry",
2427                             "uri", key.URI());
2428         MOZ_ASSERT(!request->HasCacheEntry(),
2429                    "Proxyless entry's request has cache entry!");
2430         request->SetCacheEntry(entry);
2431
2432         if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2433           mCacheTracker->MarkUsed(entry);
2434         }
2435       }
2436
2437       entry->Touch();
2438
2439       if (!newChannelCreated) {
2440         // This is ugly but it's needed to report CSP violations. We have 3
2441         // scenarios:
2442         // - we don't have cache. We are not in this if() stmt. A new channel is
2443         //   created and that triggers the CSP checks.
2444         // - We have a cache entry and this is blocked by CSP directives.
2445         DebugOnly<bool> shouldLoad = ShouldLoadCachedImage(
2446             request, aLoadingDocument, aTriggeringPrincipal, aContentPolicyType,
2447             /* aSendCSPViolationReports */ true);
2448         MOZ_ASSERT(shouldLoad);
2449       }
2450     } else {
2451       // We can't use this entry. We'll try to load it off the network, and if
2452       // successful, overwrite the old entry in the cache with a new one.
2453       entry = nullptr;
2454     }
2455   }
2456
2457   // Keep the channel in this scope, so we can adjust its notificationCallbacks
2458   // later when we create the proxy.
2459   nsCOMPtr<nsIChannel> newChannel;
2460   // If we didn't get a cache hit, we need to load from the network.
2461   if (!request) {
2462     LOG_SCOPE(gImgLog, "imgLoader::LoadImage |cache miss|");
2463
2464     bool forcePrincipalCheck;
2465     rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
2466                          aInitialDocumentURI, corsmode, aReferrerInfo,
2467                          aLoadGroup, requestFlags, aContentPolicyType,
2468                          aTriggeringPrincipal, aContext, mRespectPrivacy,
2469                          aEarlyHintPreloaderId);
2470     if (NS_FAILED(rv)) {
2471       return NS_ERROR_FAILURE;
2472     }
2473
2474     MOZ_ASSERT(NS_UsePrivateBrowsing(newChannel) == mRespectPrivacy);
2475
2476     NewRequestAndEntry(forcePrincipalCheck, this, key, getter_AddRefs(request),
2477                        getter_AddRefs(entry));
2478
2479     MOZ_LOG(gImgLog, LogLevel::Debug,
2480             ("[this=%p] imgLoader::LoadImage -- Created new imgRequest"
2481              " [request=%p]\n",
2482              this, request.get()));
2483
2484     nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(newChannel));
2485     if (cos) {
2486       if (aUseUrgentStartForChannel && !aLinkPreload) {
2487         cos->AddClassFlags(nsIClassOfService::UrgentStart);
2488       }
2489
2490       if (StaticPrefs::network_http_tailing_enabled() &&
2491           aContentPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
2492         cos->AddClassFlags(nsIClassOfService::Throttleable |
2493                            nsIClassOfService::Tail);
2494         nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(newChannel));
2495         if (httpChannel) {
2496           Unused << httpChannel->SetRequestContextID(aRequestContextID);
2497         }
2498       }
2499     }
2500
2501     nsCOMPtr<nsILoadGroup> channelLoadGroup;
2502     newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
2503     rv = request->Init(aURI, aURI, /* aHadInsecureRedirect = */ false,
2504                        channelLoadGroup, newChannel, entry, aLoadingDocument,
2505                        aTriggeringPrincipal, corsmode, aReferrerInfo);
2506     if (NS_FAILED(rv)) {
2507       return NS_ERROR_FAILURE;
2508     }
2509
2510     // Add the initiator type for this image load
2511     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(newChannel);
2512     if (timedChannel) {
2513       timedChannel->SetInitiatorType(initiatorType);
2514     }
2515
2516     // create the proxy listener
2517     nsCOMPtr<nsIStreamListener> listener = new ProxyListener(request.get());
2518
2519     MOZ_LOG(gImgLog, LogLevel::Debug,
2520             ("[this=%p] imgLoader::LoadImage -- Calling channel->AsyncOpen()\n",
2521              this));
2522
2523     mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
2524                                  nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
2525                                  aLoadGroup);
2526
2527     nsresult openRes;
2528     openRes = newChannel->AsyncOpen(listener);
2529
2530     if (NS_FAILED(openRes)) {
2531       MOZ_LOG(
2532           gImgLog, LogLevel::Debug,
2533           ("[this=%p] imgLoader::LoadImage -- AsyncOpen() failed: 0x%" PRIx32
2534            "\n",
2535            this, static_cast<uint32_t>(openRes)));
2536       request->CancelAndAbort(openRes);
2537       return openRes;
2538     }
2539
2540     // Try to add the new request into the cache.
2541     PutIntoCache(key, entry);
2542   } else {
2543     LOG_MSG_WITH_PARAM(gImgLog, "imgLoader::LoadImage |cache hit|", "request",
2544                        request);
2545   }
2546
2547   // If we didn't get a proxy when validating the cache entry, we need to
2548   // create one.
2549   if (!*_retval) {
2550     // ValidateEntry() has three return values: "Is valid," "might be valid --
2551     // validating over network", and "not valid." If we don't have a _retval,
2552     // we know ValidateEntry is not validating over the network, so it's safe
2553     // to SetLoadId here because we know this request is valid for this context.
2554     //
2555     // Note, however, that this doesn't guarantee the behaviour we want (one
2556     // URL maps to the same image on a page) if we load the same image in a
2557     // different tab (see bug 528003), because its load id will get re-set, and
2558     // that'll cause us to validate over the network.
2559     request->SetLoadId(aLoadingDocument);
2560
2561     LOG_MSG(gImgLog, "imgLoader::LoadImage", "creating proxy request.");
2562     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2563                                   aObserver, requestFlags, _retval);
2564     if (NS_FAILED(rv)) {
2565       return rv;
2566     }
2567
2568     imgRequestProxy* proxy = *_retval;
2569
2570     // Make sure that OnStatus/OnProgress calls have the right request set, if
2571     // we did create a channel here.
2572     if (newChannel) {
2573       nsCOMPtr<nsIInterfaceRequestor> requestor(
2574           new nsProgressNotificationProxy(newChannel, proxy));
2575       if (!requestor) {
2576         return NS_ERROR_OUT_OF_MEMORY;
2577       }
2578       newChannel->SetNotificationCallbacks(requestor);
2579     }
2580
2581     if (aLinkPreload) {
2582       MOZ_ASSERT(aLoadingDocument);
2583       proxy->PrioritizeAsPreload();
2584       auto preloadKey =
2585           PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2586       proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
2587     }
2588
2589     // Note that it's OK to add here even if the request is done.  If it is,
2590     // it'll send a OnStopRequest() to the proxy in imgRequestProxy::Notify and
2591     // the proxy will be removed from the loadgroup.
2592     proxy->AddToLoadGroup();
2593
2594     // If we're loading off the network, explicitly don't notify our proxy,
2595     // because necko (or things called from necko, such as imgCacheValidator)
2596     // are going to call our notifications asynchronously, and we can't make it
2597     // further asynchronous because observers might rely on imagelib completing
2598     // its work between the channel's OnStartRequest and OnStopRequest.
2599     if (!newChannel) {
2600       proxy->NotifyListener();
2601     }
2602
2603     return rv;
2604   }
2605
2606   NS_ASSERTION(*_retval, "imgLoader::LoadImage -- no return value");
2607
2608   return NS_OK;
2609 }
2610
2611 NS_IMETHODIMP
2612 imgLoader::LoadImageWithChannelXPCOM(nsIChannel* channel,
2613                                      imgINotificationObserver* aObserver,
2614                                      Document* aLoadingDocument,
2615                                      nsIStreamListener** listener,
2616                                      imgIRequest** _retval) {
2617   nsresult result;
2618   imgRequestProxy* proxy;
2619   result = LoadImageWithChannel(channel, aObserver, aLoadingDocument, listener,
2620                                 &proxy);
2621   *_retval = proxy;
2622   return result;
2623 }
2624
2625 nsresult imgLoader::LoadImageWithChannel(nsIChannel* channel,
2626                                          imgINotificationObserver* aObserver,
2627                                          Document* aLoadingDocument,
2628                                          nsIStreamListener** listener,
2629                                          imgRequestProxy** _retval) {
2630   NS_ASSERTION(channel,
2631                "imgLoader::LoadImageWithChannel -- NULL channel pointer");
2632
2633   MOZ_ASSERT(NS_UsePrivateBrowsing(channel) == mRespectPrivacy);
2634
2635   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2636       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2637
2638   LOG_SCOPE(gImgLog, "imgLoader::LoadImageWithChannel");
2639   RefPtr<imgRequest> request;
2640
2641   nsCOMPtr<nsIURI> uri;
2642   channel->GetURI(getter_AddRefs(uri));
2643
2644   NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
2645   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2646
2647   OriginAttributes attrs = loadInfo->GetOriginAttributes();
2648
2649   // TODO: Get a meaningful cors mode from the caller probably?
2650   const auto corsMode = CORS_NONE;
2651   ImageCacheKey key(uri, corsMode, attrs, aLoadingDocument);
2652
2653   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2654   channel->GetLoadFlags(&requestFlags);
2655
2656   RefPtr<imgCacheEntry> entry;
2657
2658   if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2659     RemoveFromCache(key);
2660   } else {
2661     // Look in the cache for our URI, and then validate it.
2662     // XXX For now ignore aCacheKey. We will need it in the future
2663     // for correctly dealing with image load requests that are a result
2664     // of post data.
2665     if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2666       // We don't want to kick off another network load. So we ask
2667       // ValidateEntry to only do validation without creating a new proxy. If
2668       // it says that the entry isn't valid any more, we'll only use the entry
2669       // we're getting if the channel is loading from the cache anyways.
2670       //
2671       // XXX -- should this be changed? it's pretty much verbatim from the old
2672       // code, but seems nonsensical.
2673       //
2674       // Since aCanMakeNewChannel == false, we don't need to pass content policy
2675       // type/principal/etc
2676
2677       nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2678       // if there is a loadInfo, use the right contentType, otherwise
2679       // default to the internal image type
2680       nsContentPolicyType policyType = loadInfo->InternalContentPolicyType();
2681
2682       if (ValidateEntry(entry, uri, nullptr, nullptr, nullptr, aObserver,
2683                         aLoadingDocument, requestFlags, policyType, false,
2684                         nullptr, nullptr, nullptr, corsMode, false, 0)) {
2685         request = entry->GetRequest();
2686       } else {
2687         nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(channel));
2688         bool bUseCacheCopy;
2689
2690         if (cacheChan) {
2691           cacheChan->IsFromCache(&bUseCacheCopy);
2692         } else {
2693           bUseCacheCopy = false;
2694         }
2695
2696         if (!bUseCacheCopy) {
2697           entry = nullptr;
2698         } else {
2699           request = entry->GetRequest();
2700         }
2701       }
2702
2703       if (request && entry) {
2704         // If this entry has no proxies, its request has no reference to
2705         // the entry.
2706         if (entry->HasNoProxies()) {
2707           LOG_FUNC_WITH_PARAM(
2708               gImgLog,
2709               "imgLoader::LoadImageWithChannel() adding proxyless entry", "uri",
2710               key.URI());
2711           MOZ_ASSERT(!request->HasCacheEntry(),
2712                      "Proxyless entry's request has cache entry!");
2713           request->SetCacheEntry(entry);
2714
2715           if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2716             mCacheTracker->MarkUsed(entry);
2717           }
2718         }
2719       }
2720     }
2721   }
2722
2723   nsCOMPtr<nsILoadGroup> loadGroup;
2724   channel->GetLoadGroup(getter_AddRefs(loadGroup));
2725
2726 #ifdef DEBUG
2727   if (aLoadingDocument) {
2728     // The load group of the channel should always match that of the
2729     // document if given. If that isn't the case, then we need to add more
2730     // plumbing to ensure we block the document as well.
2731     nsCOMPtr<nsILoadGroup> docLoadGroup =
2732         aLoadingDocument->GetDocumentLoadGroup();
2733     MOZ_ASSERT(docLoadGroup == loadGroup);
2734   }
2735 #endif
2736
2737   // Filter out any load flags not from nsIRequest
2738   requestFlags &= nsIRequest::LOAD_REQUESTMASK;
2739
2740   nsresult rv = NS_OK;
2741   if (request) {
2742     // we have this in our cache already.. cancel the current (document) load
2743
2744     // this should fire an OnStopRequest
2745     channel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
2746
2747     *listener = nullptr;  // give them back a null nsIStreamListener
2748
2749     rv = CreateNewProxyForRequest(request, uri, loadGroup, aLoadingDocument,
2750                                   aObserver, requestFlags, _retval);
2751     static_cast<imgRequestProxy*>(*_retval)->NotifyListener();
2752   } else {
2753     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
2754     nsCOMPtr<nsIURI> originalURI;
2755     channel->GetOriginalURI(getter_AddRefs(originalURI));
2756
2757     // XXX(seth): We should be able to just use |key| here, except that |key| is
2758     // constructed above with the *current URI* and not the *original URI*. I'm
2759     // pretty sure this is a bug, and it's preventing us from ever getting a
2760     // cache hit in LoadImageWithChannel when redirects are involved.
2761     ImageCacheKey originalURIKey(originalURI, corsMode, attrs,
2762                                  aLoadingDocument);
2763
2764     // Default to doing a principal check because we don't know who
2765     // started that load and whether their principal ended up being
2766     // inherited on the channel.
2767     NewRequestAndEntry(/* aForcePrincipalCheckForCacheEntry = */ true, this,
2768                        originalURIKey, getter_AddRefs(request),
2769                        getter_AddRefs(entry));
2770
2771     // No principal specified here, because we're not passed one.
2772     // In LoadImageWithChannel, the redirects that may have been
2773     // associated with this load would have gone through necko.
2774     // We only have the final URI in ImageLib and hence don't know
2775     // if the request went through insecure redirects.  But if it did,
2776     // the necko cache should have handled that (since all necko cache hits
2777     // including the redirects will go through content policy).  Hence, we
2778     // can set aHadInsecureRedirect to false here.
2779     rv = request->Init(originalURI, uri, /* aHadInsecureRedirect = */ false,
2780                        channel, channel, entry, aLoadingDocument, nullptr,
2781                        corsMode, nullptr);
2782     NS_ENSURE_SUCCESS(rv, rv);
2783
2784     RefPtr<ProxyListener> pl =
2785         new ProxyListener(static_cast<nsIStreamListener*>(request.get()));
2786     pl.forget(listener);
2787
2788     // Try to add the new request into the cache.
2789     PutIntoCache(originalURIKey, entry);
2790
2791     rv = CreateNewProxyForRequest(request, originalURI, loadGroup,
2792                                   aLoadingDocument, aObserver, requestFlags,
2793                                   _retval);
2794
2795     // Explicitly don't notify our proxy, because we're loading off the
2796     // network, and necko (or things called from necko, such as
2797     // imgCacheValidator) are going to call our notifications asynchronously,
2798     // and we can't make it further asynchronous because observers might rely
2799     // on imagelib completing its work between the channel's OnStartRequest and
2800     // OnStopRequest.
2801   }
2802
2803   if (NS_FAILED(rv)) {
2804     return rv;
2805   }
2806
2807   (*_retval)->AddToLoadGroup();
2808   return rv;
2809 }
2810
2811 bool imgLoader::SupportImageWithMimeType(const nsACString& aMimeType,
2812                                          AcceptedMimeTypes aAccept
2813                                          /* = AcceptedMimeTypes::IMAGES */) {
2814   nsAutoCString mimeType(aMimeType);
2815   ToLowerCase(mimeType);
2816
2817   if (aAccept == AcceptedMimeTypes::IMAGES_AND_DOCUMENTS &&
2818       mimeType.EqualsLiteral("image/svg+xml")) {
2819     return true;
2820   }
2821
2822   DecoderType type = DecoderFactory::GetDecoderType(mimeType.get());
2823   return type != DecoderType::UNKNOWN;
2824 }
2825
2826 NS_IMETHODIMP
2827 imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
2828                                   const uint8_t* aContents, uint32_t aLength,
2829                                   nsACString& aContentType) {
2830   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2831   if (channel) {
2832     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2833     if (loadInfo->GetSkipContentSniffing()) {
2834       return NS_ERROR_NOT_AVAILABLE;
2835     }
2836   }
2837
2838   nsresult rv =
2839       GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
2840   if (NS_SUCCEEDED(rv) && channel && XRE_IsParentProcess()) {
2841     if (RefPtr<mozilla::net::nsHttpChannel> httpChannel =
2842             do_QueryObject(channel)) {
2843       // If the image type pattern matching algorithm given bytes does not
2844       // return undefined, then disable the further check and allow the
2845       // response.
2846       httpChannel->DisableIsOpaqueResponseAllowedAfterSniffCheck(
2847           mozilla::net::nsHttpChannel::SnifferType::Image);
2848     }
2849   }
2850
2851   return rv;
2852 }
2853
2854 /* static */
2855 nsresult imgLoader::GetMimeTypeFromContent(const char* aContents,
2856                                            uint32_t aLength,
2857                                            nsACString& aContentType) {
2858   nsAutoCString detected;
2859
2860   /* Is it a GIF? */
2861   if (aLength >= 6 &&
2862       (!strncmp(aContents, "GIF87a", 6) || !strncmp(aContents, "GIF89a", 6))) {
2863     aContentType.AssignLiteral(IMAGE_GIF);
2864
2865     /* or a PNG? */
2866   } else if (aLength >= 8 && ((unsigned char)aContents[0] == 0x89 &&
2867                               (unsigned char)aContents[1] == 0x50 &&
2868                               (unsigned char)aContents[2] == 0x4E &&
2869                               (unsigned char)aContents[3] == 0x47 &&
2870                               (unsigned char)aContents[4] == 0x0D &&
2871                               (unsigned char)aContents[5] == 0x0A &&
2872                               (unsigned char)aContents[6] == 0x1A &&
2873                               (unsigned char)aContents[7] == 0x0A)) {
2874     aContentType.AssignLiteral(IMAGE_PNG);
2875
2876     /* maybe a JPEG (JFIF)? */
2877     /* JFIF files start with SOI APP0 but older files can start with SOI DQT
2878      * so we test for SOI followed by any marker, i.e. FF D8 FF
2879      * this will also work for SPIFF JPEG files if they appear in the future.
2880      *
2881      * (JFIF is 0XFF 0XD8 0XFF 0XE0 <skip 2> 0X4A 0X46 0X49 0X46 0X00)
2882      */
2883   } else if (aLength >= 3 && ((unsigned char)aContents[0]) == 0xFF &&
2884              ((unsigned char)aContents[1]) == 0xD8 &&
2885              ((unsigned char)aContents[2]) == 0xFF) {
2886     aContentType.AssignLiteral(IMAGE_JPEG);
2887
2888     /* or how about ART? */
2889     /* ART begins with JG (4A 47). Major version offset 2.
2890      * Minor version offset 3. Offset 4 must be nullptr.
2891      */
2892   } else if (aLength >= 5 && ((unsigned char)aContents[0]) == 0x4a &&
2893              ((unsigned char)aContents[1]) == 0x47 &&
2894              ((unsigned char)aContents[4]) == 0x00) {
2895     aContentType.AssignLiteral(IMAGE_ART);
2896
2897   } else if (aLength >= 2 && !strncmp(aContents, "BM", 2)) {
2898     aContentType.AssignLiteral(IMAGE_BMP);
2899
2900     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
2901     // CURs begin with 2-byte 0 followed by 2-byte 2.
2902   } else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
2903                               !memcmp(aContents, "\000\000\002\000", 4))) {
2904     aContentType.AssignLiteral(IMAGE_ICO);
2905
2906     // WebPs always begin with RIFF, a 32-bit length, and WEBP.
2907   } else if (aLength >= 12 && !memcmp(aContents, "RIFF", 4) &&
2908              !memcmp(aContents + 8, "WEBP", 4)) {
2909     aContentType.AssignLiteral(IMAGE_WEBP);
2910
2911   } else if (MatchesMP4(reinterpret_cast<const uint8_t*>(aContents), aLength,
2912                         detected) &&
2913              detected.Equals(IMAGE_AVIF)) {
2914     aContentType.AssignLiteral(IMAGE_AVIF);
2915   } else if ((aLength >= 2 && !memcmp(aContents, "\xFF\x0A", 2)) ||
2916              (aLength >= 12 &&
2917               !memcmp(aContents, "\x00\x00\x00\x0CJXL \x0D\x0A\x87\x0A", 12))) {
2918     // Each version is for containerless and containerful files respectively.
2919     aContentType.AssignLiteral(IMAGE_JXL);
2920   } else {
2921     /* none of the above?  I give up */
2922     return NS_ERROR_NOT_AVAILABLE;
2923   }
2924
2925   return NS_OK;
2926 }
2927
2928 /**
2929  * proxy stream listener class used to handle multipart/x-mixed-replace
2930  */
2931
2932 #include "nsIRequest.h"
2933 #include "nsIStreamConverterService.h"
2934
2935 NS_IMPL_ISUPPORTS(ProxyListener, nsIStreamListener,
2936                   nsIThreadRetargetableStreamListener, nsIRequestObserver)
2937
2938 ProxyListener::ProxyListener(nsIStreamListener* dest) : mDestListener(dest) {}
2939
2940 ProxyListener::~ProxyListener() = default;
2941
2942 /** nsIRequestObserver methods **/
2943
2944 NS_IMETHODIMP
2945 ProxyListener::OnStartRequest(nsIRequest* aRequest) {
2946   if (!mDestListener) {
2947     return NS_ERROR_FAILURE;
2948   }
2949
2950   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2951   if (channel) {
2952     // We need to set the initiator type for the image load
2953     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(channel);
2954     if (timedChannel) {
2955       nsAutoString type;
2956       timedChannel->GetInitiatorType(type);
2957       if (type.IsEmpty()) {
2958         timedChannel->SetInitiatorType(u"img"_ns);
2959       }
2960     }
2961
2962     nsAutoCString contentType;
2963     nsresult rv = channel->GetContentType(contentType);
2964
2965     if (!contentType.IsEmpty()) {
2966       /* If multipart/x-mixed-replace content, we'll insert a MIME decoder
2967          in the pipeline to handle the content and pass it along to our
2968          original listener.
2969        */
2970       if ("multipart/x-mixed-replace"_ns.Equals(contentType)) {
2971         nsCOMPtr<nsIStreamConverterService> convServ(
2972             do_GetService("@mozilla.org/streamConverters;1", &rv));
2973         if (NS_SUCCEEDED(rv)) {
2974           nsCOMPtr<nsIStreamListener> toListener(mDestListener);
2975           nsCOMPtr<nsIStreamListener> fromListener;
2976
2977           rv = convServ->AsyncConvertData("multipart/x-mixed-replace", "*/*",
2978                                           toListener, nullptr,
2979                                           getter_AddRefs(fromListener));
2980           if (NS_SUCCEEDED(rv)) {
2981             mDestListener = fromListener;
2982           }
2983         }
2984       }
2985     }
2986   }
2987
2988   return mDestListener->OnStartRequest(aRequest);
2989 }
2990
2991 NS_IMETHODIMP
2992 ProxyListener::OnStopRequest(nsIRequest* aRequest, nsresult status) {
2993   if (!mDestListener) {
2994     return NS_ERROR_FAILURE;
2995   }
2996
2997   return mDestListener->OnStopRequest(aRequest, status);
2998 }
2999
3000 /** nsIStreamListener methods **/
3001
3002 NS_IMETHODIMP
3003 ProxyListener::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3004                                uint64_t sourceOffset, uint32_t count) {
3005   if (!mDestListener) {
3006     return NS_ERROR_FAILURE;
3007   }
3008
3009   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3010 }
3011
3012 /** nsThreadRetargetableStreamListener methods **/
3013 NS_IMETHODIMP
3014 ProxyListener::CheckListenerChain() {
3015   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3016   nsresult rv = NS_OK;
3017   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3018       do_QueryInterface(mDestListener, &rv);
3019   if (retargetableListener) {
3020     rv = retargetableListener->CheckListenerChain();
3021   }
3022   MOZ_LOG(
3023       gImgLog, LogLevel::Debug,
3024       ("ProxyListener::CheckListenerChain %s [this=%p listener=%p rv=%" PRIx32
3025        "]",
3026        (NS_SUCCEEDED(rv) ? "success" : "failure"), this,
3027        (nsIStreamListener*)mDestListener, static_cast<uint32_t>(rv)));
3028   return rv;
3029 }
3030
3031 /**
3032  * http validate class.  check a channel for a 304
3033  */
3034
3035 NS_IMPL_ISUPPORTS(imgCacheValidator, nsIStreamListener, nsIRequestObserver,
3036                   nsIThreadRetargetableStreamListener, nsIChannelEventSink,
3037                   nsIInterfaceRequestor, nsIAsyncVerifyRedirectCallback)
3038
3039 imgCacheValidator::imgCacheValidator(nsProgressNotificationProxy* progress,
3040                                      imgLoader* loader, imgRequest* request,
3041                                      Document* aDocument,
3042                                      uint64_t aInnerWindowId,
3043                                      bool forcePrincipalCheckForCacheEntry)
3044     : mProgressProxy(progress),
3045       mRequest(request),
3046       mDocument(aDocument),
3047       mInnerWindowId(aInnerWindowId),
3048       mImgLoader(loader),
3049       mHadInsecureRedirect(false) {
3050   NewRequestAndEntry(forcePrincipalCheckForCacheEntry, loader,
3051                      mRequest->CacheKey(), getter_AddRefs(mNewRequest),
3052                      getter_AddRefs(mNewEntry));
3053 }
3054
3055 imgCacheValidator::~imgCacheValidator() {
3056   if (mRequest) {
3057     // If something went wrong, and we never unblocked the requests waiting on
3058     // validation, now is our last chance. We will cancel the new request and
3059     // switch the waiting proxies to it.
3060     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ false);
3061   }
3062 }
3063
3064 void imgCacheValidator::AddProxy(imgRequestProxy* aProxy) {
3065   // aProxy needs to be in the loadgroup since we're validating from
3066   // the network.
3067   aProxy->AddToLoadGroup();
3068
3069   mProxies.AppendElement(aProxy);
3070 }
3071
3072 void imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy) {
3073   mProxies.RemoveElement(aProxy);
3074 }
3075
3076 void imgCacheValidator::UpdateProxies(bool aCancelRequest, bool aSyncNotify) {
3077   MOZ_ASSERT(mRequest);
3078
3079   // Clear the validator before updating the proxies. The notifications may
3080   // clone an existing request, and its state could be inconsistent.
3081   mRequest->SetValidator(nullptr);
3082   mRequest = nullptr;
3083
3084   // If an error occurred, we will want to cancel the new request, and make the
3085   // validating proxies point to it. Any proxies still bound to the original
3086   // request which are not validating should remain untouched.
3087   if (aCancelRequest) {
3088     MOZ_ASSERT(mNewRequest);
3089     mNewRequest->CancelAndAbort(NS_BINDING_ABORTED);
3090   }
3091
3092   // We have finished validating the request, so we can safely take ownership
3093   // of the proxy list. imgRequestProxy::SyncNotifyListener can mutate the list
3094   // if imgRequestProxy::CancelAndForgetObserver is called by its owner. Note
3095   // that any potential notifications should still be suppressed in
3096   // imgRequestProxy::ChangeOwner because we haven't cleared the validating
3097   // flag yet, and thus they will remain deferred.
3098   AutoTArray<RefPtr<imgRequestProxy>, 4> proxies(std::move(mProxies));
3099
3100   for (auto& proxy : proxies) {
3101     // First update the state of all proxies before notifying any of them
3102     // to ensure a consistent state (e.g. in case the notification causes
3103     // other proxies to be touched indirectly.)
3104     MOZ_ASSERT(proxy->IsValidating());
3105     MOZ_ASSERT(proxy->NotificationsDeferred(),
3106                "Proxies waiting on cache validation should be "
3107                "deferring notifications!");
3108     if (mNewRequest) {
3109       proxy->ChangeOwner(mNewRequest);
3110     }
3111     proxy->ClearValidating();
3112   }
3113
3114   mNewRequest = nullptr;
3115   mNewEntry = nullptr;
3116
3117   for (auto& proxy : proxies) {
3118     if (aSyncNotify) {
3119       // Notify synchronously, because the caller knows we are already in an
3120       // asynchronously-called function (e.g. OnStartRequest).
3121       proxy->SyncNotifyListener();
3122     } else {
3123       // Notify asynchronously, because the caller does not know our current
3124       // call state (e.g. ~imgCacheValidator).
3125       proxy->NotifyListener();
3126     }
3127   }
3128 }
3129
3130 /** nsIRequestObserver methods **/
3131
3132 NS_IMETHODIMP
3133 imgCacheValidator::OnStartRequest(nsIRequest* aRequest) {
3134   // We may be holding on to a document, so ensure that it's released.
3135   RefPtr<Document> document = mDocument.forget();
3136
3137   // If for some reason we don't still have an existing request (probably
3138   // because OnStartRequest got delivered more than once), just bail.
3139   if (!mRequest) {
3140     MOZ_ASSERT_UNREACHABLE("OnStartRequest delivered more than once?");
3141     aRequest->CancelWithReason(NS_BINDING_ABORTED,
3142                                "OnStartRequest delivered more than once?"_ns);
3143     return NS_ERROR_FAILURE;
3144   }
3145
3146   // If this request is coming from cache and has the same URI as our
3147   // imgRequest, the request all our proxies are pointing at is valid, and all
3148   // we have to do is tell them to notify their listeners.
3149   nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(aRequest));
3150   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
3151   if (cacheChan && channel) {
3152     bool isFromCache = false;
3153     cacheChan->IsFromCache(&isFromCache);
3154
3155     nsCOMPtr<nsIURI> channelURI;
3156     channel->GetURI(getter_AddRefs(channelURI));
3157
3158     nsCOMPtr<nsIURI> finalURI;
3159     mRequest->GetFinalURI(getter_AddRefs(finalURI));
3160
3161     bool sameURI = false;
3162     if (channelURI && finalURI) {
3163       channelURI->Equals(finalURI, &sameURI);
3164     }
3165
3166     if (isFromCache && sameURI) {
3167       // We don't need to load this any more.
3168       aRequest->CancelWithReason(NS_BINDING_ABORTED,
3169                                  "imgCacheValidator::OnStartRequest"_ns);
3170       mNewRequest = nullptr;
3171
3172       // Clear the validator before updating the proxies. The notifications may
3173       // clone an existing request, and its state could be inconsistent.
3174       mRequest->SetLoadId(document);
3175       mRequest->SetInnerWindowID(mInnerWindowId);
3176       UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3177       return NS_OK;
3178     }
3179   }
3180
3181   // We can't load out of cache. We have to create a whole new request for the
3182   // data that's coming in off the channel.
3183   nsCOMPtr<nsIURI> uri;
3184   mRequest->GetURI(getter_AddRefs(uri));
3185
3186   LOG_MSG_WITH_PARAM(gImgLog,
3187                      "imgCacheValidator::OnStartRequest creating new request",
3188                      "uri", uri);
3189
3190   CORSMode corsmode = mRequest->GetCORSMode();
3191   nsCOMPtr<nsIReferrerInfo> referrerInfo = mRequest->GetReferrerInfo();
3192   nsCOMPtr<nsIPrincipal> triggeringPrincipal =
3193       mRequest->GetTriggeringPrincipal();
3194
3195   // Doom the old request's cache entry
3196   mRequest->RemoveFromCache();
3197
3198   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
3199   nsCOMPtr<nsIURI> originalURI;
3200   channel->GetOriginalURI(getter_AddRefs(originalURI));
3201   nsresult rv = mNewRequest->Init(originalURI, uri, mHadInsecureRedirect,
3202                                   aRequest, channel, mNewEntry, document,
3203                                   triggeringPrincipal, corsmode, referrerInfo);
3204   if (NS_FAILED(rv)) {
3205     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ true);
3206     return rv;
3207   }
3208
3209   mDestListener = new ProxyListener(mNewRequest);
3210
3211   // Try to add the new request into the cache. Note that the entry must be in
3212   // the cache before the proxies' ownership changes, because adding a proxy
3213   // changes the caching behaviour for imgRequests.
3214   mImgLoader->PutIntoCache(mNewRequest->CacheKey(), mNewEntry);
3215   UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3216   return mDestListener->OnStartRequest(aRequest);
3217 }
3218
3219 NS_IMETHODIMP
3220 imgCacheValidator::OnStopRequest(nsIRequest* aRequest, nsresult status) {
3221   // Be sure we've released the document that we may have been holding on to.
3222   mDocument = nullptr;
3223
3224   if (!mDestListener) {
3225     return NS_OK;
3226   }
3227
3228   return mDestListener->OnStopRequest(aRequest, status);
3229 }
3230
3231 /** nsIStreamListener methods **/
3232
3233 NS_IMETHODIMP
3234 imgCacheValidator::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3235                                    uint64_t sourceOffset, uint32_t count) {
3236   if (!mDestListener) {
3237     // XXX see bug 113959
3238     uint32_t _retval;
3239     inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &_retval);
3240     return NS_OK;
3241   }
3242
3243   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3244 }
3245
3246 /** nsIThreadRetargetableStreamListener methods **/
3247
3248 NS_IMETHODIMP
3249 imgCacheValidator::CheckListenerChain() {
3250   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3251   nsresult rv = NS_OK;
3252   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3253       do_QueryInterface(mDestListener, &rv);
3254   if (retargetableListener) {
3255     rv = retargetableListener->CheckListenerChain();
3256   }
3257   MOZ_LOG(
3258       gImgLog, LogLevel::Debug,
3259       ("[this=%p] imgCacheValidator::CheckListenerChain -- rv %" PRId32 "=%s",
3260        this, static_cast<uint32_t>(rv),
3261        NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
3262   return rv;
3263 }
3264
3265 /** nsIInterfaceRequestor methods **/
3266
3267 NS_IMETHODIMP
3268 imgCacheValidator::GetInterface(const nsIID& aIID, void** aResult) {
3269   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
3270     return QueryInterface(aIID, aResult);
3271   }
3272
3273   return mProgressProxy->GetInterface(aIID, aResult);
3274 }
3275
3276 // These functions are materially the same as the same functions in imgRequest.
3277 // We duplicate them because we're verifying whether cache loads are necessary,
3278 // not unconditionally loading.
3279
3280 /** nsIChannelEventSink methods **/
3281 NS_IMETHODIMP
3282 imgCacheValidator::AsyncOnChannelRedirect(
3283     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
3284     nsIAsyncVerifyRedirectCallback* callback) {
3285   // Note all cache information we get from the old channel.
3286   mNewRequest->SetCacheValidation(mNewEntry, oldChannel);
3287
3288   // If the previous URI is a non-HTTPS URI, record that fact for later use by
3289   // security code, which needs to know whether there is an insecure load at any
3290   // point in the redirect chain.
3291   nsCOMPtr<nsIURI> oldURI;
3292   bool schemeLocal = false;
3293   if (NS_FAILED(oldChannel->GetURI(getter_AddRefs(oldURI))) ||
3294       NS_FAILED(NS_URIChainHasFlags(
3295           oldURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &schemeLocal)) ||
3296       (!oldURI->SchemeIs("https") && !oldURI->SchemeIs("chrome") &&
3297        !schemeLocal)) {
3298     mHadInsecureRedirect = true;
3299   }
3300
3301   // Prepare for callback
3302   mRedirectCallback = callback;
3303   mRedirectChannel = newChannel;
3304
3305   return mProgressProxy->AsyncOnChannelRedirect(oldChannel, newChannel, flags,
3306                                                 this);
3307 }
3308
3309 NS_IMETHODIMP
3310 imgCacheValidator::OnRedirectVerifyCallback(nsresult aResult) {
3311   // If we've already been told to abort, just do so.
3312   if (NS_FAILED(aResult)) {
3313     mRedirectCallback->OnRedirectVerifyCallback(aResult);
3314     mRedirectCallback = nullptr;
3315     mRedirectChannel = nullptr;
3316     return NS_OK;
3317   }
3318
3319   // make sure we have a protocol that returns data rather than opens
3320   // an external application, e.g. mailto:
3321   nsCOMPtr<nsIURI> uri;
3322   mRedirectChannel->GetURI(getter_AddRefs(uri));
3323
3324   nsresult result = NS_OK;
3325
3326   if (nsContentUtils::IsExternalProtocol(uri)) {
3327     result = NS_ERROR_ABORT;
3328   }
3329
3330   mRedirectCallback->OnRedirectVerifyCallback(result);
3331   mRedirectCallback = nullptr;
3332   mRedirectChannel = nullptr;
3333   return NS_OK;
3334 }